V-221138

Discussion

Real-time multicast traffic can entail multiple large flows of data. Large unicast flows tend to be fairly isolated (i.e., someone doing a file download here or there), whereas multicast can have broader impact on bandwidth consumption, resulting in extreme network congestion. Hence, it is imperative that there is multicast admission control to restrict which multicast groups hosts are allowed to join via IGMP or MLD.

Check Content

Review the configuration of the DR to verify that it is filtering IGMP or MLD Membership Report messages, allowing hosts to join only those groups that have been approved.

Step 1: Verify that all host facing interfaces are configured to filter IGMP Membership Report messages (IGMP joins) as shown in the example below:

interface Ethernet2/4
 no switchport
 ip address 10.2.22.3/24 ip pim sparse-mode
 ip igmp version 3
 ip igmp report-policy ALLOWED_GROUPS

Step 2: Verify that the report policy denies unauthorized groups or permits only authorized groups. 

route-map ALLOWED_GROUPS permit 10
 match ip multicast group 233.1.1.0/24 
route-map ALLOWED_GROUPS permit 20
 match ip multicast group 233.1.1.0/32 
route-map ALLOWED_GROUPS permit 30
 match ip multicast group 233.1.1.1/32 
route-map ALLOWED_GROUPS deny 40
 match ip multicast group 224.0.0.0/4

Note: This requirement is only applicable to Source Specific Multicast (SSM) implementation. This requirement is not applicable to Any Source Multicast (ASM) since the filtering is being performed by the Rendezvous Point.

If the DR is not filtering IGMP or MLD Membership Report messages, this is a finding.