O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

20.9. Firewalling Between PIM Domains

Problem

You need to run a firewall between two Autonomous Systems (ASs) running PIM and MSDP.

Solution

Configure the firewall to allow MSDP, configure PIM, and then configure a multicast group policy to only allow join-prunes:

	FIREWALL-A-> set address untrust untrst-rp-10.1.1.1 10.1.1.1/32
	FIREWALL-A-> set address trust trust-rp-10.5.5.254 10.5.5.254/32
	FIREWALL-A-> set service msdp protocol tcp src-port 1024-65535 dst-port
	    639-639
	FIREWALL-A-> set policy from untrust to trust untrust-rp-10.1.1.1
	    trust-rp-10.5.5.254 msdp permit log
	FIREWALL-A-> set policy from trust to untrust trust-rp-10.5.5.254
	    untrust-rp-10.1.1.1 msdp permit log

	FIREWALL-A-> set vrouter trust-vr
	FIREWALL-A(trust-vr)-> set access-list 10 permit ip 224.0.0.0/4 10
	FIREWALL-A(trust-vr)-> set protocol pim
	FIREWALL-A(trust-vr/pim)-> set enable
	FIREWALL-A(trust-vr/pim)-> end
	FIREWALL-A-> set interface eth0/0 protocol pim
	FIREWALL-A-> set interface eth0/0 protocol pim enable
	FIREWALL-A-> set interface bgroup0 protocol pim
	FIREWALL-A-> set interface bgroup0 protocol pim enable
	FIREWALL-A->set multicast-group-policy from trust mgroup-list 10 to
	    untrust pim-message join-prune bi-directional

Discussion

To run PIM between ASs, you must use MSDP to advertise active sources between RPs in the different ASs. You do this via MSDP source active messages. MSDP runs over TCP, so like BGP, there is no need for the firewall to participate in the protocol as long as the hosts on each side of the firewall ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required