Configuring A Multicast Boundary; Filtering Pim Neighbors - Cisco FirePOWER ASA 5500 series Configuration Manual

Configuring PIM Features
hostname(config-if)# pim hello-interval seconds
Valid values for the seconds argument range from 1 to 3600 seconds.
Every 60 seconds, the security appliance sends PIM join/prune messages. To change this value, enter the
following command:
hostname(config-if)# pim join-prune-interval seconds
Valid values for the seconds argument range from 10 to 600 seconds.

Configuring a Multicast Boundary

Address scoping defines domain boundaries so that domains with RPs that have the same IP address do
not leak into each other. Scoping is performed on the subnet boundaries within large domains and on the
boundaries between the domain and the Internet.
You can set up an administratively scoped boundary on an interface for multicast group addresses using
the multicast boundary command. IANA has designated the multicast address range 239.0.0.0 to
239.255.255.255 as the administratively scoped addresses. This range of addresses can be reused in
domains administered by different organizations. They would be considered local, not globally unique.
To configure a multicast boundary, enter the following command:
hostname(config-if)# multicast boundary acl [filter-autorp]
A standard ACL defines the range of addresses affected. When a boundary is set up, no multicast data
packets are allowed to flow across the boundary from either direction. The boundary allows the same
multicast group address to be reused in different administrative domains.
You can configure the filter-autorp keyword to examine and filter Auto-RP discovery and
announcement messages at the administratively scoped boundary. Any Auto-RP group range
announcements from the Auto-RP packets that are denied by the boundary access control list (ACL) are
removed. An Auto-RP group range announcement is permitted and passed by the boundary only if all
addresses in the Auto-RP group range are permitted by the boundary ACL. If any address is not
permitted, the entire group range is filtered and removed from the Auto-RP message before the Auto-RP
message is forwarded.

Filtering PIM Neighbors

You can define the routers that can become PIM neighbors with the pim neighbor-filter command. By
filtering the routers that can become PIM neighbors, you can:
•
•
To define the neighbors that can become a PIM neighbor, perform the following steps:
Use the access-list command to define a standard access list defines the routers you want to participate
Step 1
in PIM.
For example the following access list, when used with the pim neighbor-filter command, prevents the
10.1.1.1 router from becoming a PIM neighbor:
hostname(config)# access-list pim_nbr deny 10.1.1.1 255.255.255.255
Use the pim neighbor-filter command on an interface to filter the neighbor routers.
Step 2
Cisco Security Appliance Command Line Configuration Guide
11-20
Prevent unauthorized routers from becoming PIM neighbors.
Prevent attached stub routers from participating in PIM.
Chapter 11 Configuring Multicast Routing
OL-10088-01