1、VRRP探索
1)组播:224.0.0.18
2)协议号:112,TTL=255,拒绝TTL小于255的VRRP协议报
与HSRP相同
2、缓解***
1)使用强认证(不能防重放)
·
MD5+HMAC
·
无法发现预共享密钥
interface FastEthernet0/24
vrrp 2 ip 12.1.1.1
vrrp 2 authentication md5 key-string cisco
2)ACL
·
防止HSRP欺骗,操作性不强
access-list 101 permit 112 host 1.1.1.1 host 224.0.0.18
access-list 101 permit 112 host 1.1.1.2 host 224.0.0.18
access-list 101 deny 112 any any
access-list 101 permit ip any any
interface FastEthernet0/0
ip access-group 101 in
转载于:https://blog.51cto.com/nppstudy/725982