igmp group-policy
Function
The igmp group-policy command configures an IGMP group policy on an interface to limit the range of multicast groups that the hosts can join.
The undo igmp group-policy command deletes the IGMP group policy.
By default, no IGMP group policy is configured on an interface, and the hosts can join any multicast groups.
Parameters
| Parameter | Description | Value |
|---|---|---|
| acl-number | Specifies the number of a basic ACL or an advanced ACL. The ACL defines a multicast group range. | The number of a basic ACL is an integer that ranges from 2000 to 2999. The number of an advanced ACL ranges from 3000 to 3999. |
| acl-name acl-name | Specifies the name of a named ACL. | The value is a string of 1 to 32 case-sensitive characters without spaces. The value must start with a letter (case sensitive) and can contain digits, hyphens (-), or underscores (_). |
| 1 | Sets the range of multicast groups that IGMPv1 hosts can join. | - |
| 2 | Sets the range of multicast groups that IGMPv2 hosts can join. | - |
| 3 | Sets the range of multicast groups that IGMPv3 hosts can join. | - |
Usage Guidelines
Usage Scenario
To enable hosts on the network segment connected to an interface to receive data of specified multicast groups, run the igmp group-policy command on this interface to specify an ACL as a filter to restrict the range of multicast groups. This improves IGMP security. The igmp group-policy command can also prevent the wireless access controller from forwarding multicast data to specified multicast groups.
Prerequisites
Multicast routing has been enabled using the multicast routing-enable command.
An ACL defining the range of multicast groups has been created.
Configuration Impact
After the igmp group-policy command is executed on an interface:
The interface filters the received Report messages based on the ACL and maintains memberships only for the multicast groups permitted by the ACL.
The interface discards the Report messages that are denied by the ACL. If the entries of the multicast groups denied by the ACL exist on the wireless access controller, the wireless access controller deletes these entries when the aging time of the entries expires.
If the IGMP version is not specified, the specified ACL applies to IGMPv1, IGMPv2, and IGMPv3 hosts.
Precautions
In the basic ACL view, set source in the rule command to the range of multicast groups that an interface can join.
In the advanced ACL view, set source in the rule command to the source address that is allowed to send multicast data to the specified multicast groups, and set destination to the range of multicast groups that an interface can join.
Example
# Create ACL 2005, and configure a rule that allows hosts to receive data of multicast group 225.1.1.1. Configure an IGMP group policy on VLANIF100 and reference ACL 2005 to allow hosts connected to the interface to join only multicast group 225.1.1.1.
<AC6605> system-view [AC6605] acl number 2005 [AC6605-acl-basic-2005] rule permit source 225.1.1.1 0 [AC6605-acl-basic-2005] quit [AC6605] multicast routing-enable [AC6605] interface vlanif 100 [AC6605-Vlanif100] igmp group-policy 2005
# Create an ACL named myacl, and configure a rule that allows hosts to receive data of multicast groups in the range of 225.1.0.0/16. Configure an IGMP group policy on VLANIF100 and reference the ACL to allow hosts connected to the interface to join only the specified multicast groups.
<AC6605> system-view [AC6605] acl name myacl [AC6605-acl-adv-myacl] rule permit ip destination 225.1.0.0 0.0.255.255 [AC6605-acl-adv-myacl] quit [AC6605] multicast routing-enable [AC6605] interface vlanif 100 [AC6605-Vlanif100] igmp group-policy acl-name myacl
