
Configuring IP Routers and Interfaces
2-19
• Whether datagrams received or transmitted on this interface should have their
labels stripped
You also specify whether the router creates the following types of labels:
• An implicit label, which the router uses to label unlabeled inbound datagrams,
when required
• A default label, which the router uses to label unlabeled outbound datagrams,
when required
• An error label, which the router uses to label ICMP error messages associated
with processing security options
The following sections describe how the router uses this information to handle
labeled IP traffic.
Inbound IP Datagrams
When the router receives an IP datagram on a RIPSO interface, it compares the
security classification and authority values specified in the security label with
those configured on the inbound interface.
If the interface does not require a security label for inbound IP datagrams, then the
router accepts both unlabeled IP datagrams and datagrams that meet the
classification and authority rules described in the next paragraph.
If the interface does require a security label, then for the router to accept the
datagram, the following RISPO conditions must be met:
• The datagram must be labeled.
• The security classification value in the datagram’s label must be within the
security-level range configured for the interface.
• The authority flags in the datagram’s label must include all of the flags
required for the interface and cannot contain any flags not allowed for the
interface.
The router drops any datagrams that do not meet these requirements and generates
an ICMP error message.
On a non-RIPSO interface, the router only accepts unlabeled IP datagrams and IP
datagrams that are labeled as Unclassified with no authority flags set.
Kommentare zu diesen Handbüchern