Block specific multicast traffic in C2960

[narainarun]

Hi,

I have a requirement where two routers are connected over Cisco 2960 switch wherein C2960 should block only specific multicast group. The reason is two routers are running OSPF and other multicast groups and that should not be disturbed. I cannot do this with "storm control" because it does block for all multicast group and even with "igmp filter" as it is actual multicast traffic not just IGMP. So I thought of making use of MAC ACL.

I created a MAC ACL like below to block MC traffic of group 239.255.255.255 and permit others (including OSPF MC) and applied it under the physical interface.

Extended MAC access list mcjoin
    deny   any host 0100.5e7f.ffff
    permit any any

interface <name>

mac access-group mcjoin in

But after this also the MC traffic is flowing through. Then I tried doing this with IP based ACL which works fine.

Extended IP access list 100
    10 deny ip any host 239.255.255.255
    20 permit ip any any

interface <name>

ip access-group 100 in

Would like to know whether MAC ACL will not work for blocing/allowing multicast traffic? Also is there any other better way to do this in Cisco 2960 switches?

thanks in advance

Arun

[andrew.prince]

Arun,

I would suggest and "IGMP Filter" and I am pretty sure the 2960 supports this.

HTH>

[narainarun]

Hi Andrew,

Thanks for the response. But I think "ip igmp filter" only filters the IGMP traffic flow between router and host not the multicast traffic flow between two routers and will be useful when the users are connected to the switch. I tried with "ip igmp filter" but that didnt work out.

In this case, two routers are connected over this C2960 switch and should block the multicast traffic flow between the routers.

thanks

Arun

[andrew.prince]

Arun,

The IGMP filter instructs the switch to allow which hosts can join a group. So I suggested this as an alternative solution.

If you want to stop the 2 routers to not be able to exchange just Multicast traffic this does not include dynamic routing multicasts - then disable multicast routing on the specific LAN interfaces - no pim x/x

HTH>

[narainarun]

Hi Andrew,

Apologies as I have not clearly given my requirement in the first update itself. In the real scenario, we do no have access to the two routers and we only manage a part of the network and the rest of the network is outsourced to another managed partner. Only the switch is under our control and we are asking the customer to stop sending that specific multicast group (in our case it is 239.255.255.255). Till that time we need to have a way to block specific multicast traffic in the switch and allow other multicast groups (except multicast group 239.255.255.255). Thanks again for your answer.

thanks

Arun

[andrew.prince]

Arun,

In that case I see your only option is an ACL.  And just in case there are a few IGMP Joins mixed in there try the below:-

ip access-list extended bmc

deny ip any host 239.255.255.255

permit ip any any

interface x/x
ip access-group bmc in

ip igmp access-group bmc

Regards,

Andrew.