Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 106)

2-46

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Enabling Stub Multicast Routing

Overview

SMR allows the PIX Firewall to function as a “stub router.” A stub router is a device that acts as an

Internet Group Management Protocol (IGMP) proxy agent. The IGMP is used to dynamically register

specific hosts in a multicast group on a particular LAN with a multicast (MC) router. MC routers route

multicast data transmissions to the hosts on each LAN in an internetwork that are registered to receive

specific multimedia or other broadcasts. A stub router forwards IGMP messages between hosts and MC

routers.

The Protocol Independent Multicast (PIM) protocol provides a scalable method for determining the best

paths in a network for distributing a specific multicast transmission to each host that has registered using

IGMP to receive the transmission. With PIM sparse mode (PIM/SM), which is the default for Cisco

routers, when the source of a multicast transmission begins broadcasting, the traffic is forwarded from

one MC router to the next until the packets reach every registered host. If a more direct path to the traffic

source exists, the last-hop router sends a join message toward the source that causes the traffic to be

rerouted along the better path.

Allowing Hosts to Receive Multicast Transmissions

When hosts that need to receive a multicast transmission are separated from the MC router by a

PIX

Firewall, configure the PIX Firewall to forward IGMP reports from the downstream hosts and to

forward multicast transmissions from the upstream router. The upstream router is the next-hop interface

toward the transmission source from the outside interface of the PIX

Firewall.

To allow hosts to receive multicast transmissions through the PIX Firewall, perform the following steps:

Step 1 Enable multicast forwarding on each interface by entering the following command:

multicast interface interface-name

This command enables multicast support on the specified interface and places the interface in multicast

promiscuous mode. When you enter this command, the CLI enters multicast subcommand mode and the

prompt changes to identify the interface you are configuring.

To use this command, replace interface-name with the name of the PIX Firewall interface on which you

wish to enable multicast forwarding.

Step 2 Configure the maximum number of IGMP groups, by entering the following command from multicast

subcommand mode:

igmp max-groups n

To use this command, replace n with the maximum number of IGMP groups you wish to allow on the

specified interface. The range of groups supported (max-groups) is from 1 to 2000. A value of 0 causes

no IGMP groups to be allowed.

Step 3 Enable IGMP forwarding on each PIX Firewall interface connected to hosts that will receive multicast

transmissions.

Enter the following subcommand for each multicast interface, which is typically an inside or more secure

interface.

igmp forward interface mc-source-if-name

1 2 ... 101 102 103 104 105 106 107 108 109 110 111 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 106

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525