Filter
Top Products
Multicast Features | 667
Prevent a Host from Joining a Group
You can prevent a host from joining a particular group by blocking specific IGMP reports. Create an
extended access list containing the permissible source-group pairs. Use the command
ip igmp access-group
access-list-name from INTERFACE mode to apply the access list.
In Figure 30-2, VLAN 400 is configured with an access list to permit only IGMP reports for group
239.0.0.1. Though Receiver 2 sends a membership report for groups 239.0.0.1 and 239.0.0.2, a multicast
routing table entry is created only for group 239.0.0.1. VLAN 300 has no access list limiting Receiver 1, so
both IGMP reports are accepted, and two corresponding entries are created in the routing table.
Note: For rules in IGMP access lists, source is the multicast source, not the source of the IGMP packet.
For IGMPv2, use the keyword any for source (as shown in Figure 30-2), since IGMPv2 hosts do not know
in advance who the source is for the group in which they are interested.
FTOS Behavior: Do not enter the command ip igmp access-group before creating the access-list. If
you do, upon entering your first deny rule, FTOS clears multicast routing table and re-learns all groups,
even those not covered by the rules in the access-list, because there is an implicit deny all rule at the
end of all access-lists. Therefore, configuring an IGMP join request filter in this order might result in
data loss. If you must enter the command ip igmp access-group before creating the access-list, prevent
FTOS from clearing the routing table by entering a permit any rule with high sequence number before
you enter any other rules.