Configuring Source And Destination Zones; Configuring Source And Destination Groups; Configuring Rule Options - Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual

Network and Security Manager Administration Guide

Configuring Source and Destination Zones

Configuring Source and Destination Groups

Configuring Rule Options

456
After creating an access list, you reference these access lists in a multicast rule in the
security policy for the device.
In the Multicast rulebase, you create rules to enable multicast control traffic to flow
between zones. You must create zones on your security device before you can create a
rule for that device. In a single rule:
You must select a single zone for the source zone and a single zone for the destination
zone. These zones must be available on the security devices on which you install the
policy.
You can also select multiple zone exceptions for both source and destination zones.
A zone exception includes a specific zone and the device that contains that zone.
When you create a multicast rule, specify the multicast groups for which you want to
permit multicast traffic using one of the following methods:
Specify a multicast group IP address, and optionally, the multicast group address on
the outgoing interface
Specify the access list that identifies the permitted multicast groups
Select "any" to accept traffic for all multicast groups
Rule options enable you to specify the type of multicast control traffic to which this rule
applies and whether the rule is bidirectional.
A rule can apply to either IGMP messages or PIM-SM messages:
When running IGMP proxy on the security device, configure a rule that permits IGMP
messages to flow between zones.
When running PIM-SIM on the security device, configure a rule that permits PIM-SM
messages.
In this example, you define a multicast rule that permits IGMP messages from the Trust
zone to the Untrust zone. You specify the original multicast group address object and a
different destination multicast group object.
In the main navigation tree, select Object Manager > Address Objects.
1.
In the main display area, click the Add icon and select Multicast Group. In the New
2.
Multicast Group dialog box, configure the following then click OK:
Copyright © 2010, Juniper Networks, Inc.