Multicast routing preference

Jean-Yves ANDREOLETTI · ‎11-15-2012

Dear all,

I have a problem on my catalyst 6509 on which I would like to do the following things :

I have some Vlans in which multicast is enabled.

In tose Vlan theres is a router which is default router for equipements.

I had enabled multicast routing because some Vlan needs to exchange multicast informations, but I wolud like to make difference between Multicast traffic. For example I have 5 vlans:

Vlan 1 and 2 need to exchange Multicast informations but the don't need multicast information from Vlan 3 and 4

Vlan 3 and 5 need to exchange Multicast informations but the don't need multicast information from Vlan 1 and 2

Vlan 5 is independant Vlan but doesn't need to have multicast information from all others vlan.

Last problem, equipement on differents vlan can use the same Mulkticast group address.

Here is an extract of my configuration :

!ip multicast-routing

!

!Access-list 101 permit ip 10.0.1.0 0.0.0.255 any

!Access-list 101 permit ip 10.0.2.0 0.0.0.255 any

!Access-list 102 permit ip 10.0.3.0 0.0.0.255 any

!Access-list 102 permit ip 10.0.4.0 0.0.0.255 any

!Access-list 103 permit ip 10.0.5.0 0.0.0.255 any

!

!interface vlan 11

! description VLAN 1

! ip address 10.0.1.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 101

! ip igmp access-group 101

! ip igmp version 3

!

!interface vlan 12

! description VLAN 2

! ip address 10.0.2.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 101

! ip igmp access-group 101

! ip igmp version 3

!

!interface vlan 13

! description VLAN 3

! ip address 10.0.3.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 102

! ip igmp access-group 102

! ip igmp version 3

!

!interface vlan 14

! description VLAN 4

! ip address 10.0.4.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 102

! ip igmp access-group 102

! ip igmp version 3

!

!interface vlan 15

! description VLAN 5

! ip address 10.0.3.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 103

! ip igmp access-group 103

! ip igmp version 3

In this case, Multicast routing is not working between Vlan 1 to Vlan 2 and Vlan 3 to Vlan 4.

So I need your help to solve my problem.

Br,

Jean-Yves ANDREOLETTI

Stephane Bonnet · ‎11-15-2012

Hi,

Your access-list in ip igmp access-group isn't in the best format.

You must use the same kind of filtering but you may specify the word "igmp" not "ip".

Try that:

access-list 111 permit igmp 10.0.1.0 0.0.0.255 any

access-list 111 permit igmp 10.0.2.0 0.0.0.255 any

access-list 111 deny igmp any any

access-list 112 permit igmp 10.0.3.0 0.0.0.255 any

access-list 112 permit igmp 10.0.4.0 0.0.0.255 any

access-list 112 deny igmp any any

access-list 113 permit igmp 10.0.5.0 0.0.0.255 any

access-list 113 deny igmp any any

And if you try to use only PIM SSM because of enabling igmp version 3 on your interface.

- disable pim dense mode

- you need to activate PIM SSM on the default range 232/8 or on the range you choose with one of these commands:

ip pim ssm default

ip pim ssm range {access-list}

By the way to avoid these kinds of filtering perhaps using VRF-Lite with PIM sparse-mode and different RPs in each VRF is a best solution.

Stephane

Jean-Yves ANDREOLETTI · ‎11-15-2012

Tanks for your answer, do I need to keep the command "ip multicast boundary {access-list}" ?

Br,

Jean-Yves

Stephane Bonnet · ‎11-15-2012

I think you can use the two for safety:

- inside your vlan your receivers will are only allowed to join some multicast group via igmp access-group

- ip multicast boundary add another security by filtering control and also data plane traffic in multicast

Stephane

Jean-Yves ANDREOLETTI · ‎11-15-2012

OK,

I redo my configuration to have the following one :

!Access-list 101 permit igmp 10.0.1.0 0.0.0.255 any

!Access-list 101 permit igmp 10.0.2.0 0.0.0.255 any

!Access-list 101 deny igmp any any

!Access-list 102 permit igmp 10.0.3.0 0.0.0.255 any

!Access-list 102 permit igmp 10.0.4.0 0.0.0.255 any

!Access-list 102 deny igmp any any

!Access-list 103 permit igmp 10.0.5.0 0.0.0.255 any

!Access-list 102 deny igmp any any

!

!interface vlan 11

! description VLAN 1

! ip address 10.0.1.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 101

! ip igmp access-group 101

! ip igmp version 3

! mls rp vtp-domain {VTP_Domain}

! mls rp ip

!

!interface vlan 12

! description VLAN 2

! ip address 10.0.2.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 101

! ip igmp access-group 101

! ip igmp version 3

! mls rp vtp-domain {VTP_Domain}

! mls rp ip

!

!interface vlan 13

! description VLAN 3

! ip address 10.0.3.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 102

! ip igmp access-group 102

! ip igmp version 3

! mls rp vtp-domain {VTP_Domain}

! mls rp ip

!

!interface vlan 14

! description VLAN 4

! ip address 10.0.4.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 102

! ip igmp access-group 102

! ip igmp version 3

! mls rp vtp-domain {VTP_Domain}

! mls rp ip

!

!interface vlan 15

! description VLAN 5

! ip address 10.0.3.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 103

! ip igmp access-group 103

! ip igmp version 3

! mls rp vtp-domain {VTP_Domain}

! mls rp ip

When I try , the multicast packets are not routed.

When I disable the command "ip multicast boundary {access-list}", the multicast packets are routed.

How can you explain this ?

Br,

Jean-Yves ANDREOLETTI

Stephane Bonnet · ‎11-15-2012

You have misinterpret the configuration i gave to you, you need to have 2 differents access-list in multicast boundary and igmp access-group.

Keep your first access-list you use (101 & 102 with ip statement) in your first post for multicast boundary and use these i gave you for igmp access-group (111 & 112 with igmp statement).

Stephane

Jean-Yves ANDREOLETTI · ‎11-15-2012

OK, I redo my configuration like that:

!

!Access-list 101 permit ip 10.0.1.0 0.0.0.255 any

!Access-list 101 permit ip 10.0.2.0 0.0.0.255 any

!Access-list 102 permit ip 10.0.3.0 0.0.0.255 any

!Access-list 102 permit ip 10.0.4.0 0.0.0.255 any

!Access-list 103 permit ip 10.0.5.0 0.0.0.255 any

!

!Access-list 111 permit igmp 10.0.1.0 0.0.0.255 any

!Access-list 111 permit igmp 10.0.2.0 0.0.0.255 any

!Access-list 111 deny igmp any any

!Access-list 112 permit igmp 10.0.3.0 0.0.0.255 any

!Access-list 112 permit igmp 10.0.4.0 0.0.0.255 any

!Access-list 112 deny igmp any any

!Access-list 113 permit igmp 10.0.5.0 0.0.0.255 any

!Access-list 113 deny igmp any any

!

!interface vlan 11

! description VLAN 1

! ip address 10.0.1.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 101

! ip igmp access-group 111

! ip igmp version 3

! mls rp vtp-domain {VTP_Domain}

! mls rp ip

!

!interface vlan 12

! description VLAN 2

! ip address 10.0.2.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 101

! ip igmp access-group 111

! ip igmp version 3

! mls rp vtp-domain {VTP_Domain}

! mls rp ip

!

!interface vlan 13

! description VLAN 3

! ip address 10.0.3.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 102

! ip igmp access-group 112

! ip igmp version 3

! mls rp vtp-domain {VTP_Domain}

! mls rp ip

!

!interface vlan 14

! description VLAN 4

! ip address 10.0.4.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 102

! ip igmp access-group 112

! ip igmp version 3

! mls rp vtp-domain {VTP_Domain}

! mls rp ip

!

!interface vlan 15

! description VLAN 5

! ip address 10.0.3.253 255.255.255.0

! ip pim dense-mode

! ip multicast boundary 103

! ip igmp access-group 113

! ip igmp version 3

! mls rp vtp-domain {VTP_Domain}

! mls rp ip

But I have still the same problem of multicast packet routing that I can correct by disabling command ip multicast boundary on all interfaces.

Jean-Yves