Configuring IGMP Features
IP hosts use IGMP to report their group memberships to directly connected multicast routers. IGMP uses group addresses (Class D IP address) as group identifiers. Host group address can be in the range 224.0.0.0 to 239.255.255.255. The address 224.0.0.0 is never assigned to any group. The address 224.0.0.1 is assigned to all systems on a subnet. The address 224.0.0.2 is assigned to all routers on a subnet.
When you enable multicast routing on the security appliance, IGMP Version 2 is automatically enabled on all interfaces.
Note Only the no igmp command appears in the interface configuration when you use the show run command. If the multicast-routing command appears in the device configuration, then IGMP is automatically enabled on all interfaces.
This section describes how to configure optional IGMP setting on a per-interface basis. This section includes the following topics:
• Disabling IGMP on an Interface, page 11-15
• Configuring Group Membership, page 11-15
• Configuring a Statically Joined Group, page 11-15
• Controlling Access to Multicast Groups, page 11-15
• Limiting the Number of IGMP States on an Interface, page 11-16
• Modifying the Query Interval and Query Timeout, page 11-16
• Changing the Query Response Time, page 11-17
• Changing the IGMP Version, page 11-17
|
Disabling IGMP on an Interface |
|
|
You can disable IGMP on specific interfaces. This is useful if you know that you do not have any |
|
|
multicast hosts on a specific interface and you want to prevent the security appliance from sending host |
|
|
query messages on that interface. |
|
|
To disable IGMP on an interface, enter the following command: |
|
|
hostname(config-if)# no igmp |
|
|
To reenable IGMP on an interface, enter the following command: |
|
|
hostname(config-if)# igmp |
|
|
Note |
Only the no igmp command appears in the interface configuration. |
|
Configuring |
Group Membership |
|
You can configure the security appliance to be a member of a multicast group. Configuring the security |
|
|
appliance to join a multicast group causes upstream routers to maintain multicast routing table |
|
|
information for that group and keep the paths for that group active. |
|
|
To have the security appliance join a multicast group, enter the following command: |
|
|
hostname(config-if)# igmp join-group group-address |
|
|
Configuring |
a Statically Joined Group |
|
Sometimes a group member cannot report its membership in the group, or there may be no members of |
|
|
a group on the network segment, but you still want multicast traffic for that group to be sent to that |
|
|
network segment. You can have multicast traffic for that group sent to the segment in one of two ways: |
|
|
• Using the igmp join-group command (see Configuring Group Membership, page 11-15). This |
|
|
causes the security appliance to accept and to forward the multicast packets. |
|
|
• Using the igmp static-group command. The security appliance does not accept the multicast |
|
|
packets but rather forwards them to the specified interface. |
|
|
To configure a statically joined multicast group on an interface, enter the following command: |
|
|
hostname(config-if)# igmp static-group group-address |
|
|
Controlling Access to Multicast Groups |
|
|
To control the multicast groups that hosts on the security appliance interface can join, perform the |
|
|
following steps: |
|
|
Step 1 |
Create an access list for the multicast traffic. You can create more than one entry for a single access list. |
|
You can use extended or standard access lists. |
|
|
• To create a standard access list, enter the following command: |
|
hostname(config)# access-list name standard [permit | deny] ip_addr mask
The ip_addr argument is the IP address of the multicast group being permitted or denied. • To create an extended access list, enter the following command:
hostname(config)# access-list name extended [permit | deny] protocol src_ip_addr src_mask dst_ip_addr dst_mask
The dst_ip_addr argument is the IP address of the multicast group being permitted or denied. Step 2 Apply the access list to an interface by entering the following command:
hostname(config-if)# igmp access-group acl
The acl argument is the name of a standard or extended IP access list.
Post a comment