IP multicast PIM neighbor filter

The IP multicast PIM neighbor filter feature allows you to control which devices can be PIM neighbors.

When two PIM-enabled neighbor devices exchange Hello packets at regular intervals they become PIM neighbors by default. The IP multicast PIM neighbor filter feature gives you more control over which devices can be PIM neighbors by configuring the ip pim neighbor-filter command or ipv6 pim neighbor-filter command. You can configure the ACL to filter PIM Hello packets from sources you want to deny or allow, thereby controlling those devices' eligibility to become PIM neighbors.

Figure 1. Multicast PIM filter topology

Table 1. Configurations for devices running IP multicast PIM filters
Device 1 Device 2

access-list 10 deny host 10.0.0.2

access-list 10 permit any

interface ethernet 1/1/1

enable

ip address 10.0.0.1/24

ip pim-sparse

ip pim neighbor-filter 10

interface ethernet 1/1/2

enable

ip address 10.0.0.2/24

ip pim-sparse

Limitations

ACLs deny all access by default and you must configure the access-list permit command to permit access to one or more devices. You can configure the access-list permit all command on an interface to permit traffic on the interface to pass through without filtering.

An interface can have only one ACL configured on it.

There are no checks to validate whether an ACL applies to an interface. If the interface has no ACL, a warning that no filtering can occur is displayed.

The IP multicast PIM neighbor filter feature supports a maximum of 128 PIM neighbor filters for both IPv4 and IPv6.

Precedence-value matching in extended-ACL configurations is not supported. Refer to the FastIron Security Configuration Guide for information on ACLs.