160
•
Determine the assert timeout timer (global value/interface value).
•
Determine the join/prune interval (global value/interface level value).
•
Determine the join/prune timeout (global value/interface value).
•
Determine the multicast source lifetime.
•
Determine the maximum size of join/prune messages.
•
Determine the maximum number of (S, G) entries in each join/prune message.
•
Determine the DSCP value for PIM messages.
Configuring a multicast data filter
In either a PIM-DM domain or a PIM-SM domain, routers examine passing-by multicast data based
on the configured filtering rules and determine whether to forward the multicast data. In other words,
PIM routers can act as multicast data filters. These filters can help implement traffic control and also
control the information available to downstream receivers to enhance data security.
Generally, a smaller distance from the filter to the multicast source results in a more remarkable
filtering effect.
To configure a multicast data filter:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter public network PIM
view or VPN instance PIM
view.
pim
[
vpn-instance
vpn-instance-name
]
N/A
3.
Configure a multicast group
filter.
source-policy
acl-number
No multicast data filter by default.
This filter works not only on
independent multicast data but
also on multicast data
encapsulated in register
messages.
Configuring a hello message filter
Along with the wide applications of PIM, the security requirement for the protocol is becoming
increasingly demanding. The establishment of correct PIM neighboring relationships is the
prerequisite for secure application of PIM. To guard against PIM message attacks, you can configure
a legal source address range for hello messages on interfaces of routers to ensure the correct PIM
neighboring relationships.
To configure a hello message filter:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface
interface-type
interface-number
N/A
3.
Configure a hello message
filter.
pim neighbor-policy
acl-number
No hello message filter by default.
