01-17-2024 07:34 AM - edited 01-18-2024 12:07 AM
I am trying to block all outgoing multicast streams on my edge switch nexus 3k. The port is connected to a remote location and is a trunk port. I have devices receiving video streams inside my network through this port and I need to keep it working, while only stopping the devices on the remote-location from taking video streams from my network. I tried to accomplish this using access lists.
1- I created an access list as below:
IP access list remote-location
10 deny ip any 232.10.10.1/32 vlan 835
11 deny ip any 224.52.74.17/32 vlan 835
12 deny ip any 224.2.42.17/32 vlan 835
13 deny ip any 224.2.42.16/32 vlan 835
14 deny ip any 224.2.51.60/32 vlan 835
15 deny udp any 224.91.40.1/32 eq 2001 vlan 835
16 deny udp any 224.91.40.2/32 eq 2003 vlan 835
17 deny udp any 224.91.40.4/32 eq 2007 vlan 835
I applied it in the inward direction on the port as below:
interface Ethernet1/7
description **connected to remote-location**
ip access-group remote-location in
no lldp transmit
no lldp receive
switchport mode trunk
switchport trunk native vlan 835
switchport trunk allowed vlan 835,837
load-interval counter 1 5
load-interval counter 2 5
My interface outgoing traffic rate is not dropping.
input rate 1.68 Gbps, 154.36 Kpps; output rate 1.80 Gbps, 193.82 Kpps <-- expecting to see output rate equals to almost zero
Can anyone please help me to achieve this?
@
01-18-2024 03:37 PM - edited 01-20-2024 02:35 AM
I've got no replies so far but I did some updates which I'll add it here. Hopefully, someone with a higher knowledge of this can assist.
IGMP snooping is enabled on all the switches and the streaming vlans, and the interface vlan 835 is set to PIM passive. I'm using PIM dense mode on the switch connected to the streaming servers. The devices at the remote location are requesting the multicast streams.
Vlan 835:
--------
IGMP snooping : Enabled
CAPWAP enabled : Disabled
IGMPv2 immediate leave : Disabled
Explicit host tracking : Enabled
Multicast router learning mode : pim-dvmrp
CGMP interoperability mode : IGMP_ONLY
Last Member Query Interval : 1000
I've just tried to put the ACL in outward direction and I have added few lines in ACL to match the direction but still whatever I also added a rate limit policy on the interface, the data rate is not dropping. Although I want to keep the input multicast traffic but for the sake of troubleshooting I even tried to set the storm limit to 1% with no avail. Please see all my update config as below:
IP access list remote-location
1 deny ip any 224.0.0.0/4
2 deny ip 224.0.0.0/4 any
3 deny ip 232.0.0.0/4 any
4 deny ip any 232.0.0.0/4
5 deny ip any 10.235.0.254/32
10 deny ip any 232.10.10.1/32 vlan 835
11 deny ip any 224.52.74.17/32 vlan 835
12 deny ip any 224.2.42.17/32 vlan 835
13 deny ip any 224.2.42.16/32 vlan 835
14 deny ip any 224.2.51.60/32 vlan 835
15 deny udp any 224.91.40.1/32 eq 2001 vlan 835
16 deny udp any 224.91.40.2/32 eq 2003 vlan 835
17 deny udp any 224.91.40.4/32 eq 2007 vlan 835
18 deny udp any 224.91.50.3/32 eq 2005 vlan 835
20 deny ip any 224.2.4.1/32 vlan 835
21 deny ip any 224.10.70.15/32 vlan 835
22 deny ip any 224.10.70.1/32 vlan 835
23 deny ip any 224.10.70.2/32 vlan 835
24 deny udp any 224.2.5.20/32 eq 1234 vlan 835
30 deny ip any 224.2.4.3/32 vlan 835
40 deny ip any 224.2.4.4/32 vlan 835
50 deny ip any 224.2.4.5/32 vlan 835
60 deny ip any 228.1.1.1/32 vlan 835
interface Ethernet1/7
description **connected to remote-location**
ip access-group remote-location in
ip access-group remote-location out
no lldp transmit
no lldp receive
switchport mode trunk
switchport trunk native vlan 835
switchport trunk allowed vlan 835,837
storm-control multicast level 1.00
load-interval counter 1 5
load-interval counter 2 5
rate-limit cpu direction output pps 10 action log
# Traffic Rates are still the same:
input rate 1.65 Gbps, 151.90 Kpps; output rate 1.84 Gbps, 197.08 Kpps
01-18-2024 05:19 PM
Where are you applying this ACL - on nexus switch ? what nexus code running ?
on what basis you have identified the traffic rate is only Multicast ?
did you applied any ACL Logs see is the traffic hitting that ACL ?
01-19-2024 04:25 AM - edited 01-20-2024 08:22 PM
Where are you applying this ACL - on nexus switch ? what nexus code running ? Nexus 3064PQ, NXOS: version 7.0(3)I4(6)
Please see the output of show version below.
on what basis you have identified the traffic rate is only Multicast ?
For multiple reasons:
1- The company on the remote side is taking streams from us for re-broadcasting. There are only video streaming devices on this vlan for them to capture.
2- The access-list applied is only a deny list of multicast addresses ending with the hidden deny statement for all. So, expecting no other traffic other than the multicast.
did you applied any ACL Logs see is the traffic hitting that ACL ?
Yes, I updated the ACL with the log command and can't see anything hitting the ACL.
IP access list remote-location
1 deny ip any 224.0.0.0/4 log
2 deny ip 224.0.0.0/4 any log
3 deny ip 232.0.0.0/4 any log
4 deny ip any 232.0.0.0/4 log
5 deny ip any 10.235.0.254/32 log
6 deny ip any 232.10.10.1/32 vlan 835 log
no output from " show logging ip access-list cache"
#show logging
Logging console: enabled (Severity: critical)
Logging monitor: enabled (Severity: notifications)
Logging linecard: enabled (Severity: notifications)
Logging timestamp: Seconds
Logging source-interface : disabled
Logging server: disabled
Logging origin_id : disabled
Logging logflash: disabled
Logging logfile: enabled
#show logging ip access-list status
Max flow = 8001
Alert interval = 490
Threshold value = 490
#show version
Software
BIOS: version 4.0.0
NXOS: version 7.0(3)I4(6)
BIOS compile time: 12/05/2016
NXOS image file is: bootflash:///nxos.7.0.3.I4.6_compact_N3064.bin
NXOS compile time: 3/9/2017 22:00:00 [03/10/2017 09:05:18]
Hardware
cisco Nexus3000 C3064PQ Chassis
Intel(R) Celeron(R) CPU P4505 @ 1.87GHz with 3903304 kB of memory.
Processor Board ID FOC17366ZQZ
I am not sure if this helps:
show hardware access-list output entries
slot 1
=======
Flags: F - Fragment entry E - Port Expansion
D - DSCP Expansion M - ACL Expansion
T - Cross Feature Merge Expansion
N - NS Transit B - BCM Expansion C - COPP
VDC-1 CoPP :
====================
no acl related hardware resources found
VDC-1 UF-All Ports in VDC 1 :
====================
no acl related hardware resources found
VDC-1 System-QoS :
====================
no acl related hardware resources found
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide