All things related to multicast

[Hugh LaMaster <>]

On Wed, 14 Jul 1999, Wallace, Steven S wrote:

> Hugh, does the following change address your immediate concerns?  I think it
> makes more sense to filter SA coming in to Abilene rather than our current
> practice of just restricting outbound SA.  If this looks good we can

I filter in both directions, actually; but, if you don't have any
test subnets "inside" Abilene, that may not be necessary.
Even if you have outbound filters, you still should have
inbound filters to avoid creating unnecessary router state.

> implement tonight or morning.  

I don't recall when Cisco said that the AutoRP groups
would be filtered by default.  I would include them
in the list as well unless I knew for sure they were
filtered outbound in the IOS versions used:


access-list 111 deny   ip any host 224.0.1.39
access-list 111 deny   ip any host 224.0.1.40

 
> Current configuration:
> 
> ip msdp peer 134.68.3.1
> ip msdp sa-filter out 134.68.3.1 list 111
> access-list 111 deny   ip any 239.0.0.0 0.255.255.255
> access-list 111 permit ip any any
> 
> Proposed configuration:
> 
> ip msdp peer 134.68.3.1
> ip msdp sa-filter in 134.68.3.1 list 111

ip msdp sa-filter out 134.68.3.1 list 111

> access-list 111 deny   ip any 239.0.0.0 0.255.255.255
> access-list 111 deny   ip any 224.0.1.22 255.255.255.255
> access-list 111 deny   ip any 224.0.1.35 255.255.255.255
> access-list 111 deny   ip any 224.0.1.24 255.255.255.255

access-list 111 deny   ip any host 224.0.1.39
access-list 111 deny   ip any host 224.0.1.40

> access-list 111 deny   ip any 224.0.1.60 255.255.255.255
> access-list 111 deny   ip any 224.0.1.2 255.255.255.255
> access-list 111 deny   ip any 224.0.2.2 255.255.255.255
> access-list 111 permit ip any any

I agree with the rest of the list.


--
 Hugh LaMaster, M/S 233-21,    Email: 

 NASA Ames Research Center     Or:    

 Moffett Field, CA 94035-1000  Or:    

 Phone: 650/604-1056           Disc:  Unofficial, personal *opinion*.