Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 516 / 1026

Configuring Multicast Rules
A multicast rule is a statement that defines a specific type of multicast control traffic.
When multicast control traffic passes through a security device, the device attempts to
match that traffic against its list of rules. If a rule is matched, the device permits the traffic
to pass through.
On security devices, you secure multicast control traffic using access lists. First, you create
an access list, which defines one of the following:
• The multicast groups a host can join.
• The sources from which traffic can be received.
After creating an access list, you reference these access lists in a multicast rule in the
security policy for the device.
Configuring Source and Destination Zones
In the Multicast rulebase, you create rules to enable multicast control traffic to flow
between zones. You must create zones on your security device before you can create a
rule for that device. In a single rule:
•
You must select a single zone for the source zone and a single zone for the destination
zone. These zones must be available on the security devices on which you install the
policy.
•
You can also select multiple zone exceptions for both source and destination zones.
A zone exception includes a specific zone and the device that contains that zone.
Configuring Source and Destination Groups
When you create a multicast rule, specify the multicast groups for which you want to
permit multicast traffic using one of the following methods:
• Specify a multicast group IP address, and optionally, the multicast group address on
the outgoing interface
•
Specify the access list that identifies the permitted multicast groups
•
Select “any” to accept traffic for all multicast groups
Configuring Rule Options
Rule options enable you to specify the type of multicast control traffic to which this rule
applies and whether the rule is bidirectional.
A rule can apply to either IGMP messages or PIM-SM messages:
•
When running IGMP proxy on the security device, configure a rule that permits IGMP
messages to flow between zones.
• When running PIM-SIM on the security device, configure a rule that permits PIM-SM
messages.
Copyright © 2010, Juniper Networks, Inc. 466
Network and Security Manager Administration Guide