igmp query ip-source-policy
Function
The igmp query ip-source-policy command configures IGMP Query message filtering based on source addresses.
The undo igmp query ip-source-policy command restores the default configuration.
By default, no source address-based IGMP Query message filtering is configured.
Format
igmp query ip-source-policy { basic-acl-number | acl-name acl-name }
undo igmp query ip-source-policy
Parameters
| Parameter | Description | Value |
|---|---|---|
| basic-acl-number | Specifies the number of a basic ACL, which defines the range of source addresses. | The value is an integer that ranges from 2000 to 2999. |
| acl-name acl-name | Specifies the name of an ACL. | The name is a string of 1 to 32 case-sensitive characters without spaces. The name must start with an uppercase or a lowercase letter and can contain letters, digits, underscores (_), and hyphens (-). |
Usage Guidelines
Usage Scenario
If an attacker sends forged IGMP Query messages with an IP addresses smaller than the querier IP address, the querier will be replaced by the attacker. As a result, the real querier cannot implement fast leave of group members and bandwidth is wasted. Source address-based IGMP Query message filtering can protect the querier from such attacks. After this function is configured on a device, the device accepts only the IGMP Query messages with source addresses permitted by the specified ACL. This function controls querier election.
IGMP Query messages are encapsulated into IP messages. This command is used to filter IGMP Query messages based on the source addresses in IP headers.
This command configures a policy to filter IGMP Query messages based on source addresses. The ACL referenced in the policy defines the source addresses allowed. The device accepts only the IGMP Query messages with source addresses in the allowed range.
Prerequisites
Multicast routing has been enabled using the multicast routing-enable command.
Example
<AC6605> system-view [AC6605] multicast routing-enable [AC6605] acl number 2001 [AC6605-acl-basic-2001] rule permit source 10.10.1.1 0 [AC6605-acl-basic-2001] quit [AC6605] interface vlanif 100 [AC6605-Vlanif100] igmp query ip-source-policy 2001
