Multicast boundary DMVPN

[thoward1]

I am running a dual hub, single cloud DMVPN. There is any source multicast traffic being produced and consumed on the network. Both DMVPN hubs are rendevouz points, using MSDP.

There is a host that is producing multicast traffic on the network behind one of the hubs to a specific multicast group. I want to prevent this multicast traffic from being accessible at the second hub router as well as at certain spoke routers. There is other multicast traffic that the same host is producing to a separate multicast group and I still want this traffic to be available everywhere.

There seems to be a lot of multicast security options but it isn't clear if any could help with what I am trying to achieve. What would be the suggested method to use?

[Mohammed al Baqari]

Hi,

You can use multi-cast boundary interface command as your 2nd hub and
specific spokes to allow the required multicast groups.

Let's say that you have group 239.1.1.1 to be blocked from 2nd hub and x
spokes and group 239.2.2.2 to be allowed for all nodes.

At your hub 2 and x spokes you can create a stand ACLs to allow 239.2.2.2
only. Then you apply to exit interfaces to block multicast traffic to
239.1.1.1

***** remember to rate useful posts

[thoward1]

Thanks for the info.

Blocking the multicast group on the 2nd hub and at the prohibited spokes was a backup plan.

I was hoping to block the multicast traffic from ever getting to those routers in the first place. I would like the permitted routers to have control over where the traffic goes rather than the prohibited routers having control (if that is possible).

[Mohammed al Baqari · Accepted solution]

You can use PIM Allow-RP feature at the hub which can do the same job by
have multiple dummy RPs for different groups and accordingly control which
spokes join the group using static pointing.


https://www.cisco.com/en/US/docs/ios-xml/ios/ipmulti_pim/configuration/15-2s/imc_pim_allowrp.html