Dell Force10 E600i FTOS Version 8.4.1.5 Configuration Guide for ExaScale - Page 637

FTOS Behavior: Do not enter the command ip igmp access-group before creating the access-list. If you do, upon entering your first deny rule, FTOS clears multicast routing table and re-learns all groups, even those not covered by the rules in the access-list, because there is an implicit deny all rule at the end of all access-lists. Therefore, configuring an IGMP join request filter in this order might result in data loss. If you must enter the command ip igmp access-group before creating the access-list, prevent FTOS from clearing the routing table by entering a permit any rule with high sequence number before you enter any other rules. In Figure 33-2, VLAN 400 is configured with an access list to permit only IGMP reports for group 239.0.0.1. Though Receiver 2 sends a membership report for groups 239.0.0.1 and 239.0.0.2, a multicast routing table entry is created only for group 239.0.0.1. VLAN 300 has no access list limiting Receiver 1, so both IGMP reports are accepted, and two corresponding entries are created in the routing table. Figure 33-2. Preventing a Host from Joining a Group Source 2 10.11.1.2 interface GigabitEthernet 2/31 ip pim sparse-mode ip address 10.11.23.1/24 no shutdown interface GigabitEthernet 3/21 ip pim sparse-mode ip address 10.11.23.2/24 no shutdown Source 1 10.11.5.2 interface GigabitEthernet 2/1 ip pim sparse-mode ip address 10.11.1.1/24 no shutdown interface GigabitEthernet 3/1 ip pim sparse-mode ip address 10.11.5.1/24 no shutdown 2/1 interface GigabitEthernet 2/11 ip pim sparse-mode ip address 10.11.12.2/24 no shutdown R1(conf-if-vl-400)# do show ip pim tib RP interface GigabitEthernet 1/21 ip pim sparse-mode ip address 10.11.12.1/24 no shutdown PIM Multicast Routing Table R1 Flags: D - Dense, S - Sparse, C - Connected, L - Local, P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPT, M - MSDP created entry, A - Candidate for MSDP Advertisement K - Ack-Pending State Timers: Uptime/Expires Interface state: Interface, next-Hop, State/Mode R2 3/1 2/31 3/21 239.0.0.2 239.0.0.1 R3 2/11 ip multicast-routing 3/11 ip pim rp-address 10.11.12.2 group-address 224.0.0.0/4 router rip network 10.0.0.0 interface GigabitEthernet 3/11 ip pim sparse-mode ip address 10.11.13.2/24 no shutdown 1/21 1/31 interface GigabitEthernet 1/31 ip pim sparse-mode ip address 10.11.13.1/24 no shutdown R1(conf )#do show run acl ! ip access-list extended igmpjoinfilR2G2 seq 5 permit ip any host 239.0.0.1 R1(conf-if-vl-300)# do show ip pim tib (*, 239.0.0.1), uptime 00:00:06, expires 00:00:00, RP 10.11.12.2, flags: SCJ Incoming interface: GigabitEthernet 1/21, RPF neighbor 10.11.12.2 Outgoing interface list: Vlan 400 Forward/Sparse 00:00:06/Never interface Vlan 400 ip pim sparse-mode ip address 10.11.4.1/24 untagged GigabitEthernet 1/2 ip igmp access-group igmpjoinfilR2G2 no shutdown ip igmp snooping enable interface Vlan 300 ip pim sparse-mode ip address 10.11.3.1/24 untagged GigabitEthernet 1/1 no shutdown Receiver 1 10.11.3.2 Group: 239.0.0.1, 239.0.0.2 Receiver 2 10.11.4.2 Group: 239.0.0.1, 239.0.0.2 PIM Multicast Routing Table Flags: D - Dense, S - Sparse, C - Connected, L - Local, P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPT, M - MSDP created entry, A - Candidate for MSDP Advertisement K - Ack-Pending State Timers: Uptime/Expires Interface state: Interface, next-Hop, State/Mode (*, 239.0.0.1), uptime 00:00:07, expires 00:00:00, RP 10.11.12.2, flags: SCJ Incoming interface: GigabitEthernet 1/21, RPF neighbor 10.11.12.2 Outgoing interface list: Vlan 300 Forward/Sparse 00:00:07/Never (*, 239.0.0.2), uptime 00:01:10, expires 00:00:00, RP 10.11.12.2, flags: SCJ Incoming interface: GigabitEthernet 1/21, RPF neighbor 10.11.12.2 Outgoing interface list: Vlan 300 Forward/Sparse 00:01:10/Never Rate Limit IGMP Join Requests If you expect a burst of IGMP Joins, protect the IGMP process from overload by limiting that rate at which new groups can be joined using the command ip igmp group-join-limit from INTERFACE mode. Hosts whose IGMP requests are denied will use the retry mechanism built-in to IGMP so that they're membership is delayed rather than permanently denied. View the enable status of this feature using the command show ip igmp interface from EXEC Privilege mode. Multicast Features | 637