Foundry Networks FESX - Using Acls to Control Multicast Traffic Boundaries

Foundry Configuration Guide for the FESX, FSX, and FWSX
19 - 62 © Foundry Networks, Inc. December 2005
FastIron SuperX Router(config-if-1/1)# ip pim-sparse
FastIron SuperX Router(config-if-1/1)# exit
FastIron SuperX Router(config)# access-list 5 deny host 239.255.162.2
FastIron SuperX Router(config)# access-list 5 permit 239.0.0.0 0.0.255.255
FastIron SuperX Router(config)# router pim
FastIron SuperX Router(config-pim-router)# bsr-candidate ethernet 1/1 32 100
FastIron SuperX Router(config-pim-router)# rp-candidate ethernet 1/1 group-list 5
The example above shows a configuration for an Ethernet interface. To configure ACLs that are applied to a virtual
routing interface, enter commands such as the following:
FastIron SuperX Router(config)# interface ve 16
FastIron SuperX Router(config-vif-16)# ip address 16.16.16.1 255.255.255.0
FastIron SuperX Router(config-vif-16)# ip pim-sparse
FastIron SuperX Router(config-vif-16)# exit
FastIron SuperX Router(config)# access-list 5 deny host 239.255.162.2
FastIron SuperX Router(config)# access-list 5 permit 239.255.0.0 0.0.255.255
FastIron SuperX Router(config)# router pim
FastIron SuperX Router(config-pim-router)# bsr-candidate ve 16 32 100
FastIron SuperX Router(config-pim-router)# rp-candidate ve 16 group-list 5
To configure ACLs that are applied to a loopback interface, enter commands such as the following:
FastIron SuperX Router(config)# interface loopback 1
FastIron SuperX Router(config-lbif-1)# ip address 88.88.88.8 255.255.255.0
FastIron SuperX Router(config-lbif-1)# ip pim-sparse
FastIron SuperX Router(config-lbif-1)# exit
FastIron SuperX Router(config)# access-list 5 deny host 239.255.162.2
FastIron SuperX Router(config)# access-list 5 permit 239.255.0.0 0.0.255.255
FastIron SuperX Router(config)# router pim
FastIron SuperX Router(config-pim-router)# bsr-candidate loopback 1 32 100
FastIron SuperX Router(config-pim-router)# rp-candidate loopback 1 group-list 5
Syntax: [no] rp-candidate ethernet [<slotnum>/]<portnum> | loopback <num> | ve <num> [group-list <access-list-
num>]
The <slotnum> parameter is required on chassis devices.
The <portnum> | loopback <num> | ve <num> parameter specifies the interface. The Layer 3 Switch will
advertise the specified interface’s IP address as a candidate RP.
• Enter ethernet [<slotnum>/]<portnum> for a physical interface (port).
• Enter ve <num> for a virtual interface.
• Enter loopback <num> for a loopback interface.
The group-list <access-list-num> indicates that a standard ACL is used to filter for which multicast group the
advertisement will be made.
NOTE: Extended ACLs cannot be used for group-list.
Using ACLs to Control Multicast Traffic Boundaries
You can create ACLs that determine which multicast traffic packets can be forwarded on an interface in a PIM or
DVMRP domain. The ACLs can be create to be applied to a range of multicast group addresses. If an ACL denies
the specified multicast group addresses, incoming or outgoing packets from those addresses will not be allowed to
flow across the interface.