Sie sind auf Seite 1von 66

Deploying IP Multicast

Session RST-2051

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 2

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 1
Geekometer

Agenda

Basic Multicast Engineering


Advanced Multicast Engineering

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 3

Basic Multicast Engineering

PIM Configuration Steps


Which Mode: Sparse or Dense?
RP Engineering

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 4

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 2
PIM Configuration Steps

Enable Multicast Routing on every router


Configure every interface for PIM
Configure the RP
Using Auto-RP or BSR
Configure certain routers as Candidate RP(s)
All other routers automatically learn elected RP
Anycast/Static RP addressing
RP address must be configured on every router
Note: Anycast RP requires MSDP

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 5

Configure PIM on Every Interface


Classic Partial Multicast Cloud Mistake #1
src

T1/E1 line has best metric to source

no ip pim dense-mode T1/E1 56K/64K ip pim dense-mode


X

Well just use


the spare 56K line
for the IP Multicast
RPF Failure!!!!!
traffic and not
the T1. Network
rcvr
Engineer
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 6

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 3
Configure PIM on Every Router
Classic Partial Multicast Cloud Mistake #2
src

Highest next-hop IP address used for


RPF when equal cost paths exist.

RPF Failure!!!!!
Multicast Enabled Multicast Disabled
A B
.1 192.168.1.0/24 .2
X E0

Well just keep


multicast traffic off C
E1
of certain routers in
the network.
Network rcvr
Engineer
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 7

Basic Multicast Engineering

PIM Configuration Steps


Which Mode: Sparse or Dense?
RP Engineering

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 8

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 4
Which ModeSparse or Dense

Dense mode
Flood and Prune behavior very inefficient
Can cause problems in certain network topologies
Creates (S, G) state in EVERY router
Even when there are no receivers for the traffic
Complex Assert mechanism
Mixed control and data planes
Results in (S, G) state in every router in the network
Can result in non-deterministic topological behavior
Read: It can black-
black-hole traffic and/or melt down your network!
Primarily usage:
Testing a routers performance in the lab
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 9

Which ModeSparse or Dense

Sparse mode
Must configure a Rendezvous Point (RP)
Very efficient
Uses Explicit Join model
Traffic only flows to where its needed
Separated control and data planes
Router state only created along flow paths
Deterministic topological behavior
Scales well
Works for both sparsely or densely populated networks

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 10

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 5
Which ModeSparse or Dense

CONCLUSION

Sparse mode Good! Dense mode


Bad!

Source: The Cavemans Guide to IP Multicast, 2000, R. Davis

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 11

Group Mode vs. Interface Mode

Group & Interface mode are independent.


Interface Mode
Determines how the interface operates when
sending/receiving multicast traffic.
Group Mode
Determines whether the group is Sparse or
Dense.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 12

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 6
Group Mode

Group mode is controlled by local RP info


Local RP Information
Stored in the Group-to-RP Mapping Cache
May be statically configured or learned via
Auto-RP or BSR
If RP info exists, Group = Sparse
If RP info does not exist, Group = Dense
Mode Changes are automatic.
i.e. if RP info is lost, Group falls back to Dense.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 13

Configuring Interface

Interface Mode Configuration Commands


Enables multicast forwarding on the interface.
Controls the interfaces mode of operation.
ip pim dense-mode
Interface mode is set to Dense mode operation.
ip pim sparse-mode
Interface mode is set to Sparse mode operation.
ip pim sparse-dense-mode
Interface mode is determined by the Group mode.
If Group is Dense, interface operates in Dense mode.
If Group is Sparse, interface operates in Sparse mode.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 14

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 7
Basic Multicast Engineering

PIM Configuration Steps


Which Mode: Sparse or Dense?
RP Engineering

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 15

RP Engineering

RP Configuration Methods
General RP Recommendations
Avoiding DM Fallback
Using Multiple Group Ranges

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 16

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 8
RP Configuration Methods

Static
Auto-RP
BSR
Anycast-RPs

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 17

Static RPs

Hard-coded RP address
When used, must be configured on every router
All routers must have the same RP address
RP fail-over not possible
Exception: If Anycast RPs are used. (More on that later.)
Group can never fall back into Dense mode.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 18

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 9
Auto-RP Overview

Announce
MA MA
Announce
A
A B
B

Announce Announce Announce Announce


C
C D
D
C-RP C-RP
1.1.1.1 2.2.2.2

Announce
Announce

RP- Announcements multicast to the


Cisco Announce (224.0.1.39) group
Announce

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 19

Auto-RP Overview
ry
ery

ove
cov

Disc
Dis

Dis Disc
cov
ery ove
MA ry MA
Dis Disc
A
A cov
ery B
B ove
ry
ry
ery

ove
cov

Disc

C D
Dis

C D
C-RP C-RP
1.1.1.1 2.2.2.2

RP-Discoveries multicast to the


Cisco Discovery (224.0.1.40) group
Discovery

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 20

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 10
BSR Overview

BSR Election Process

Msg
Msg

Msg
BSR
BSR
BSR

BSR
BSR
Msg C-BSR BSR
Msg C-BSR Msg C-BSR
A BSR
Msg F
D BSR BSR
Msg Msg

Msg
Msg

Msg
BSR
BSR

BSR
B C

BSR Msgs
E
BSR Msgs Flooded Hop -by-Hop

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 21

BSR Overview
Highest Priority C-BSR
is elected as BSR

BSR
A
D F

B C

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 22

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 11
BSR Overview

BSR
A
D C- F
RP
nt Ad
me v
tise (un ertise
dver st) ica me
A a st) nt
RP (unic
C-

C-RP C-RP
B C

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 23

BSR Overview

G
Msg
BSR

BSR
Msg
BSR
A BSR
D Msg F
Msg
BSR

C-RP C-RP
B C

BSR Msgs
E
BSR Msgs containing RP-set
Flooded Hop-by-Hop

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 24

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 12
Anycast RPOverview

Src Src

RP1 RP2
MSDP
X
A
A B
B
SA SA
10.1.1.1 10.1.1.1

Rec Rec Rec Rec

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 25

Anycast RPOverview

Src Src

RP1 RP2
X

A
A B
B
10.1.1.1 10.1.1.1

Rec Rec Rec Rec

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 26

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 13
RP Engineering

RP Configuration Methods
General RP Recommendations
Avoiding DM Fallback
Using Multiple Group Ranges

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 27

General RP Recommendations

Use Anycast RPs:


When network must connect to Internet or
When rapid RP failover is critical
Pros
Fastest RP Convergence method
Required when connecting to Internet
Cons
Requires more configuration
Requires use of MSDP between RPs
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 28

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 14
General RP Recommendations

Use Auto-RP
When minimum configuration is desired and/or
When maximum flexibility is desired
Pros
Most flexible method
Easiest to maintain
Cons
Increased RP Failover times vs Anycast
Special care needed to avoid DM Fallback
Some methods greatly increase configuration
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 29

General RP Recommendations

Use BSR:
When Static/Anycast RPs cannot be used and
When maximum interoperability is needed
Pros
Interoperates with all Vendors
Cons
Increased RP Failover times vs Anycast
Special care needed to avoid DM Fallback
Some methods greatly increase configuration
Not as field-proven as other methods
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 30

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 15
Dense Mode Fallback

Caused by loss of local RP information.


Entry in Group-to-RP mapping cache times out.
Can happen when:
All C-RPs fail.
Auto-RP/BSR mechanism fails.
Generally a result of network congestion.
Group is switched over to Dense mode.
Dense mode state is created in the network.
Dense mode flooding begins if interfaces configured as
ip pim sparse
sparse- -dense
dense- -mode
mode.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 31

Dense Mode Fallback

Avoiding Dense Mode Fallback


To always guarantee Sparse mode
operation (and avoid falling back to
Dense mode), make sure that every
router always knows of an RP for
every group.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 32

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 16
Avoiding DM Fallback Current Workaround

Define an RP-of-last-resort
Configure as a Static RP on every router
Will only be used if all Candidate-RPs fail
Can be a dummy address or local Loopback
Recommendation: Use local Loopback on each router
MUST use ACL to avoid breaking Auto-
Auto-RP!
ip pim rp-address <RP-of-last-resort> 10
access-list 10 deny 224.0.1.39
access-list 10 deny 224.0.1.40
access-list 10 permit any

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 33

Avoiding DM Flooding Future

New IOS global command


ip pim autorp-listener
Added support for Auto-RP Environments
Modifies interface behavior
Interface always uses DM for Auto-RP groups
Permits use of ip pim sparse
sparse- -mode interfaces
and Auto-RP.
Prevents DM Flooding
When ip pim sparse-mode used on interfaces.
sparse-
Does not prevent DM Fallback!
Available soon
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 34

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 17
Avoiding DM Flooding Future

Deploying ip pim autorp


autorp--listener
Must be configured on every router.
Use RP-of-last-resort on older IOS versions
until upgraded
Assign local Loopback as RP-of-last-resort on
each router.
Example
ip pim rp-address <local_loopback> 10
access-list 10 deny 224.0.1.39
access-list 10 deny 224.0.1.40
access-list 10 permit any

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 35

Avoiding DM Fallback Future

New IOS global command


no ip pim dm-fallback

Totally prevents DM Fallback!!


No DM Flooding since all state remains in SM
Default RP Address = 0.0.0.0 [nonexistent]
Used if all RPs fail.
Results in loss of Shared Tree.
All SPTs remain active.
Available soon
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 36

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 18
RP Engineering

RP Configuration Methods
General RP Recommendations
Avoiding DM Fallback
Using Multiple Group Ranges

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 37

Using Multiple Group Ranges

Definition:
Different RPs for different group ranges
Often used to:
Directly connect an RP to group sources
Assumes Few-to-many application model
Split up RP workload over multiple RPs
Provide different Shared Tree topologies
Used with spt-threshold = infinity
Caveats:
Try to avoid overlapping group ranges
Can cause unexpected RP election results
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 38

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 19
Using Multiple Group Ranges

RP/Mapping Agent
LO0: 172.16.22.1

A B
PIM
Sparse Mode

C RP/Mapping Agent D
LO0: 172.16.25.1

ip pim send-rp-announce Loopback0 scope 16 group-list 20


ip pim send-rp-discovery Loopback0 scope 16
!
access-list 20 permit 224.0.0.0 15.255.255.255
access-list 20 permit 239.255.0.0 0.0.255.255

ip pim send-rp-announce Loopback0 scope 16 group-list 20


ip pim send-rp-discovery Loopback0 scope 16
! C-RP/Mapping Agent Configs
access-list 20 permit 224.0.0.0 15.255.255.255
access-list 20 permit 225.0.0.0 0.255.255.255

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 39

Using Multiple Group Ranges

RP/Mapping Agent
LO0: 172.16.22.1

A B
PIM
Rtr-B#show ip pim rp mapping
PIM Group-to-RP Mappings
Sparse Mode
This system is an RP (Auto-RP)
This system is an RP-mappingCagent (Loopback0)
RP/Mapping Agent D
LO0: 172.16.25.1
Group(s) 224.0.0.0/4
RP 172.16.25.1 (R5), v2v1
Info source: 172.16.25.1 (R5), via Auto-RP
Uptime: 01:05:03, expires: 00:02:27
RP 172.16.22.1 (R2), v2v1
Info source: 172.16.22.1 (R2), via Auto-RP Mapping Agents Group -to-RP
Uptime: 01:05:11, expires: 00:02:43 mapping cache contains all learned
Group(s) 225.0.0.0/8 C-RPs ordered by Group, Mask length,
RP 172.16.25.1 (R5), v2v1 and C-RP address.
Info source: 172.16.25.1 (R5), via Auto-RP
Uptime: 00:17:29, expires: 00:02:29
Group(s) 239.255.0.0/16
RP 172.16.22.1 (R2), v2v1
Info source: 172.16.22.1 (R2), via Auto-RP
Uptime: 00:56:18, expires: 00:02:41

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 40

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 20
Using Multiple Group Ranges

RP/Mapping Agent
LO0: 172.16.22.1

A B
PIM
Rtr-B#show ip pim rp mapping
PIM Group-to-RP Mappings
Sparse Mode
This system is an RP (Auto-RP)
This system is an RP-mappingCagent (Loopback0)
RP/Mapping Agent D
LO0: 172.16.25.1
Group(s) 224.0.0.0/4
RP 172.16.25.1 (R5), v2v1
Info source: 172.16.25.1 (R5), via Auto-RP
Uptime: 01:05:03, expires: 00:02:27
RP 172.16.22.1 (R2), v2v1
Info source: 172.16.22.1 (R2), via Auto-RP
Uptime: 01:05:11, expires: 00:02:43
Group(s) 225.0.0.0/8 Mapping Agent advertises elected
RP 172.16.25.1 (R5), v2v1 RPs in Discovery Messages
Info source: 172.16.25.1 (R5), via Auto-RP
Uptime: 00:17:29, expires: 00:02:29 Note: Elected RP is always listed as
Group(s) 239.255.0.0/16 first C-RP for a Group Range.
RP 172.16.22.1 (R2), v2v1
Info source: 172.16.22.1 (R2), via Auto-RP
Uptime: 00:56:18, expires: 00:02:41
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 41

Using Multiple Group Ranges

RP/Mapping Agent
LO0: 172.16.22.1

A B
PIM
Sparse Mode

C RP/Mapping Agent D
LO0: 172.16.25.1
Rtr-D#sh ip pim rp map
PIM Group-to-RP Mappings

Group(s) 224.0.0.0/4
RP 172.16.25.1 (Rtr-C), v2v1
Info source: 172.16.25.1 (Rtr-C), via Auto -RP
Uptime: 01:00:14, expires: 00:02:25
Group(s) 225.0.0.0/8 Resulting Group-to-RP Mapping
RP 172.16.25.1 (Rtr-C), v2v1 Cache in all non-MA routers
Info source: 172.16.25.1 (Rtr-C), via Auto -RP
Uptime: 00:12:40, expires: 00:02:24
Group(s) 239.255.0.0/16 (Notice that only elected RPs
RP 172.16.22.1 (Rtr-B), v2v1 are contained the Group-to-RP
Info source: 172.16.25.1 (Rtr-C), via Auto -RP mapping cache in non-MA
Uptime: 00:51:28, expires: 00:02:24
routers.)
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 42

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 21
Using Multiple Group Ranges

RP/Mapping Agent
LO0: 172.16.22.1

A B
PIM
Sparse Mode Join 239.255.1.1

C RP/Mapping Agent D
LO0: 172.16.25.1
Rtr-D#sh ip pim rp map
PIM Group-to-RP Mappings

Group(s) 224.0.0.0/4
RP 172.16.25.1 (Rtr-C), v2v1 Which entry will the router use
Info source: 172.16.25.1 (Rtr-C), via Auto -RP to determine RP address?
Uptime: 01:00:14, expires: 00:02:25
Group(s) 225.0.0.0/8
RP 172.16.25.1 (Rtr-C), v2v1 This one? (It has the highest
Info source: 172.16.25.1 (Rtr-C), via Auto -RP RP address.)
Uptime: 00:12:40, expires: 00:02:24
Group(s) 239.255.0.0/16 Or this one? (It has the
RP 172.16.22.1 (Rtr-B), v2v1
Info source: 172.16.25.1 (Rtr-C), via Auto -RP longest mask.)
Uptime: 00:51:28, expires: 00:02:24
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 43

Using Multiple Group Ranges

RP/Mapping Agent
LO0: 172.16.22.1

A B
PIM
Sparse Mode Join 239.255.1.1

C RP/Mapping Agent D
LO0: 172.16.25.1
Rtr-D#sh ip pim rp map
PIM Group-to-RP Mappings

Group(s) 224.0.0.0/4
RP 172.16.25.1 (Rtr-C), v2v1 Answer:
Info source: 172.16.25.1 (Rtr-C), via Auto -RP Router uses longest match
Uptime: 01:00:14, expires: 00:02:25 to find matching entry in the
Group(s) 225.0.0.0/8
RP 172.16.25.1 (Rtr-C), v2v1 Group-to-RP mapping cache.
Info source: 172.16.25.1 (Rtr-C), via Auto -RP
Uptime: 00:12:40, expires: 00:02:24
Group(s) 239.255.0.0/16 Moral:
RP 172.16.22.1 (Rtr-B), v2v1 Avoid overlapping group
Info source: 172.16.25.1 (Rtr-C), via Auto -RP ranges to reduce the chances
Uptime: 00:51:28, expires: 00:02:24
of incorrect RP selection.
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 44

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 22
Overlapping Group Ranges
239.255.255.255
Local Scope Local Scope
239.255.0.0/16 239.255.0.0/16
239.255.0.0

239.252.255.255
Organization -Local Scope Organization -Local Scope
239.192.0.0/14 239.192.0.0/14
239.192.0.0
Use non-
non-overlapping group
ranges. Especially when
Global Scope using Admin. Scoping.
224.0.0.0/4
238.255.255.255 Global Scope
224.0.0.0/8
225.0.0.0/8
Avoid!!! 226.0.0.0/8
.
Can result in .
confusion and .
misconfiguration 236.0.0.0/8
237.0.0.0/8
224.0.0.0 238.0.0.0/8

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 45

Overlapping Group Ranges


239.255.255.255
access-list 10 permit 239.255.0.0 0.0.255.255 Local Scope
239.255.0.0/16
239.255.0.0

239.252.255.255
access-list 20 permit 239.192.0.0 0.0.64.255
Organization -Local Scope
239.192.0.0/14
239.192.0.0
Use non-
non-overlapping group
ranges. Especially when
using Admin. Scoping.
238.255.255.255 Global Scope
224.0.0.0/8
access-list 30 permit 224.0.0.0 0.0.255.255
access-list 30 permit 225.0.0.0 0.0.255.255 225.0.0.0/8
access-list 30 permit 226.0.0.0 0.0.255.255 226.0.0.0/8
. .
.
. .
access-list 30 permit 236.0.0.0 0.0.255.255 .
access-list 30 permit 237.0.0.0 0.0.255.255
access-list 30 permit 238.0.0.0 0.0.255.255 236.0.0.0/8
237.0.0.0/8
224.0.0.0 238.0.0.0/8

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 46

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 23
Overlapping Group Ranges

Avoiding Overlapping Group Ranges


Cant use deny clause in C-RP ACLs
Implies Dense-mode Override
ip pim send-rp-announce loopback0 scope 16 group-list 10
access-
access-list 10 deny 239.0.0.0 0.255.255.255
access-list 10 permit 224.0.0.0 15.255.255.255

Must only use permit clauses


ip pim send-rp-announce loopback0 scope 16 group-list 10
access-list 10 permit 224.0.0.0 0.255.255.255
access-list 10 permit 225.0.0.0 0.255.255.255
.
.
.
access-list 10 permit 238.0.0.0 0.255.255.255

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 47

Agenda

Basic Multicast Engineering


Advanced Multicast Engineering

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 48

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 24
Advanced Multicast Engineering

Security
High Availability
Using Admin. Scoped Zones
Scaling Multicast Performance

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 49

Controlling Receivers
IGMP Access-Group Approach
interface VLAN100
ip igmp access-group IPMC -ACL

ip access -list standard IPMC -ACL


permit 239.192.244.1
deny any

No filter (default)
VL
AN
101

IP/TV
100
AN
VL Permit VT Stream
Deny Executive Meeting Stream

This is micro-management of IP Multicast traffic!!!


RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 50

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 25
Controlling Source Registration

Global command
ip pim accept-register [list <acl>] | [route-map <map>]
Used on RP to filter incoming Register messages
Filter on Source address alone (Simple ACL)
Filter on (S, G) pair (Extended ACL)
May use route-map to specify what to filter
Filter by AS-PATH if (m)BGP is in use.
Helps prevents unwanted sources from sending
First hop router blocks traffic from reaching net
Note: Traffic can still flow under certain situations

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 51

Controlling Source Registration

RP
RP configured to only accept
Registers from specific source.

ip pim accept-register list 10

access-list 10 permit 192.16.1.1

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 52

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 26
Controlling Source Registration

RP

Register-Stop
Register
Unwanted source traffic hits
first-hop router.
Unwanted Sender
First-hop router creates (S,G)
state and sends Register.
First-hop
RP rejects Register, sends
Source Traffic back a Register-Stop.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 53

Controlling Source Registration


Weaknesses in accept-
accept-register usage.
RP
Traffic will flow on local
subnet where source resides.

Traffic will flow from first-hop


Unwanted Sender router down any branches of
the Shared Tree.
Receiver First-hop Results when (*,G) OIL is
copied to (S,G) OIL at first-hop
router.
Causes (S,G) traffic to flow
Shared Tree down all interfaces in (*,G) OIL
of first-hop router.
Fundamental limitation of PIM
protocol.
Receiver Receiver

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 54

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 27
Disabling Entire Group Ranges

Accept-Register Method
ip pim accept-register group-list 10
access-list 10 deny 224.2.0.0 0.0.255.255
access-list 10 permit any

Pros
Only configured on RP(s)
Cons
Shared Trees and (*,G) state still created.
Results in unwanted (*,G) PIM Control Traffic.
Source traffic can still flow.
(See previous section on Accept-Register)
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 55

Disabling Entire Group Ranges

Garbage Can RP Method


Concept:
Separate RP for disabled groups
Could be non-existant router
Blackholes all Registers and Joins
Implementation:
Define separate RP for disabled groups
Use Auto-RP, BSR or Static RP definition
Disable RP functionality on Garbage Can RP
Use accept-rp command on GC RP to deny it from
serving as RP for the disabled group range.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 56

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 28
Disabling Entire Group Ranges

Garbage Can RP Method


Pros:
Few if any.
Cons:
Periodic Registers still sent to GC RP
Periodic Joins still sent to GC RP
Has same source issues as Accept-Register
Source traffic can still flow under certain conditions.
Adds significant complexity to network

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 57

Disabling Entire Group Ranges

Local Loopback RP Method


Concept:
Only Auto-RP-learned groups are authorized.
All other groups are considered unauthorized.
Implementation:
Define local Loopback as RP for unauthorized
groups on each router.
ip pim rp-address <local_loopback> 10
access-list 10 permit 224.2.0.0 0.0.255.255
Note: The permit clause defines the unauthorized group.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 58

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 29
Disabling Entire Group Ranges

Local Loopback RP Method


Operation:
Each router serves as RP for unauthorized
groups.
Collapses PIM-SM domain of unauthorized groups down
to the local router.
Unauthorized group traffic cannot flow beyond
local router.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 59

Disabling Entire Group Ranges

Local Loopback RP Method


Pros:
No PIM control traffic sent.
Local router is RP so no Registers/Joins are sent.
No additional workload on local router.
First-hop routers always have to create state anyway.
Can also serve as RP-of-last-resort
Solving DM Fallback problem at the same time.
Cons:
Must be configured on every router.
Local sources can still send to local receivers.
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 60

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 30
Disabling Entire Group Ranges

Recommendation
Use Local Loopback RP Method
Effectively disables unauthorized group traffic.
Can also serve as RP-of-last-resort
ip pim rp-address <local_loopback> 10
access-list 10 deny 224.0.1.39
access-list 10 deny 224.0.1.40
access-list 10 permit any

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 61

Disabling Entire Group Ranges Future

New no ip pim dm-fallback command


Undefined (via Auto-RP or BSR) groups default
to an RP address of 0.0.0.0.
Effectively disables any group unlearned
groups.
Available soon.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 62

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 31
Preventing RP-Spoofing DoS Attacks

Global command
ip pim rp-announce-filter rp-list <acl> [group-list <acl>]
rp-list <acl>
Specifies from which routers C-RP Announcements are
accepted.
group-list <acl>
Specifies which groups in the C-RP Announcement are
accepted.
If not specified, defaults to deny all groups

Use on Mapping Agents to filter out bogus C-RPs


Some protection from RP-Spoofing denial-of-service
attacks
Multiple commands may be configured as needed
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 63

Preventing RP-Spoofing DoS Attacks


Use ip pim rp
rp--announce
announce--filter on RP
Use me as your RP Use me as your RP

Mapping Agent 10.6.2.1

ip pim rp-announce-filter rp-list 11 group-list 12


access-list 11 permit 10.6.2.1 !IP address of Permitted RP
access-list 12 permit 239.192.240.0 0.0.3.255 !Permit MoH
access-list 12 permit 239.192.244.0 0.0.3.255 !Permit Low Stream
access-list 12 permit 239.192.248.0 0.0.3.255 !Permit Medium Stream
access-list 12 permit 239.255.0.0 0.0.255.255 !Permit High Stream
access-list 12 deny 239.0.0.0 0.255.255.255 !Deny remaining Admin. Scoped range
access-list 12 permit 224.0.0.0 15.255.255.255 !Permit Link Local/Reserved Addr.

Using this configuration allows the router to accept RP announcements from only
the RP in access-list 11 for group ranges described in access-list 12

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 64

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 32
Advanced Multicast Engineering

Security
High Availability
Using Admin. Scoped Zones
Scaling Multicast Performance

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 65

Auto-RP Failover

RP failover time
Function of Holdtime in C-RP Announcement
Holdtime = 3 x <rp-announce-interval>
Default < rp-announce-interval> = 60 seconds
Default Failover ~ 3 minutes
Minimizing impact of RP failure
Use SPTs to reduce impact
Traffic on SPTs not affected by RP failure
Immediate switch to SPTs is on by default
New and/or bursty sources still a problem
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 66

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 33
Tuning Auto-RP Failover

Tune Candidate RPs


Use interval clause to control failover times
ip pim send-rp-announce <intfc> scope <ttl>
[group-list acl]
[interval <seconds>]

Allows rp-announce-interval to be adjusted


Smaller intervals = Faster RP failover
Smaller intervals increase amount Auto-RP traffic
Increase is usually insignificant
Total RP failover time reduced
Min. failover ~ 3 seconds
Consider using Anycast RP for faster failover
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 67

DR Failover

A B
.2 (DR) 192.168.1.0/24 .1

Rtr -B>show ip pim neighbor


PIM Neighbor Table
Neighbor Address Interface Uptime Expires Mode
192.168.1.2 Ethernet0 4d22h 00:01:18
00:01:18 Sparse-Dense (DR)

Depends on neighbor expiration time


Expiration Time sent in PIM query messages
Expiration time = 3 x <query-interval>
Default <query-interval> = 30 seconds
DR Failover ~ 90 seconds (worst case) by default

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 68

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 34
DR Failover

Tune PIM query interval


Use interface configuration command
ip pim query-interval <period> [msec]
Default <period> = seconds
msec keyword available beginning with 12.1(11b)E
Permits DR failover to be adjusted
Min. DR failover ~ 3 seconds (worst case)
Smaller intervals increase PIM query traffic
Increase is usually insignificant

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 69

Advanced Multicast Engineering

Security
High Availability
Using Admin. Scoped Zones
Scaling Multicast Performance

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 70

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 35
Administratively-Scoped Zones

Used to limit:
High-BW sources to local site
Control sensitive multicast traffic
Simple scoped zone example:
239.255.0.0/16 = (Site) Local Scope
239.192.0.0/14 = Organization-Local Scope
224.1.0.0 - 238.255.255.255 = Global scope (Internet) zone
High-BW sources use Site-Local scope
Low-Med. BW sources use Org.-Local scope
Internet-wide sources use Global scope

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 71

Administratively-Scoped Zones
Site A (HQ)

Site-Local Boundaries block


high-rate 239.255.0.0/16
239.255.0.0/16
traffic from going out the
WAN links.

Border A
Site-Local Site-Local
S0
S1

Boundaries Boundaries

Site B (LA) S0 Site C (ATL)


S0

Border B Border C

239.255.0.0/16 239.255.0.0/16

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 72

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 36
Administratively-Scoped Zones
Site A (HQ)

Site-Local Boundaries block


high-rate 239.255.0.0/16
239.255.0.0/16
traffic from going out the
Interface Serial0
ip multicast boundary 10 WAN links.
access-list 10 deny 239.255.0.0 0.0.255.255 Interface Serial0
ip multicast boundary 10
access-list 10 permit any Border A
Site-Local Site-Local
S0 access-list 10 deny 239.255.0.0 0.0.255.255

S1
Boundaries Boundaries
access-list 10 permit any

Site B (LA) S0 Site C (ATL)

S0
Border B Border C

Interface Serial0
ip multicast boundary 10
239.255.0.0/16 239.255.0.0/16
Interface Serial1
ip multicast boundary 10

access-list 10 deny 239.255.0.0 0.0.255.255


access-list 10 permit any

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 73

Administratively-Scoped Zones
Auto-RP Example
Site A (HQ)

Site Local Site Local


C-RP/MA C-RP/MA
Each site needs its own set
of Site Local C-RPs and
Mapping Agent(s).

Border A
S0
S1

Site B (LA) S0 Site C (ATL)


S0

Border B Border C

Site Local Site Local Site Local Site Local


C-RP/MA C-RP/MA C-RP/MA C-RP/MA

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 74

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 37
Administratively-Scoped Zones
Auto-RP Example
Site A (HQ)

Site Local Site Local


C-RP/MA C-RP/MA
Problem: Site-Local RP info
can leak into other sites and
cause wrong C-RP to be
elected.

Border A
S0

S1
Site B (LA) S0 Site C (ATL)

S0
Border B Border C

Site Local Site Local Site Local Site Local


C-RP/MA C-RP/MA C-RP/MA C-RP/MA

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 75

Administratively-Scoped Zones
Preventing Auto-RP Info Leakage

Multicast Boundary Command


ip multicast boundary <acl> [filter-autorp]

New filter-autorp option


Filters contents of Auto-RP packets
Filters both Announcement and Discovery messages
C-RP entries that fail <acl> are removed from packet
Prevents C-RP information from leaking in/out of
scoped zone.
Greatly simplifies Admin. Scoped Zone support
in Auto-RP.
Available in 12.0(22)S, 12.2(12).
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 76

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 38
Administratively-Scoped Zones
Preventing Auto-RP Info Leakage

How filter-autorp option works:


For each RP Entry in Auto-RP packet:
If group-range in RP-Entry intersects any
denied group-range in the Multicast Boundary
ACL, delete RP Entry from Auto-RP packet.
If resulting Auto-RP packet is non-empty,
forward across multicast boundary.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 77

Administratively-Scoped Zones
Preventing Auto-RP Info Leakage

Using Multicast Boundary filter-autorp


Avoid Auto-RP Group-Range Overlaps
Overlapping ranges can intersect denied
ranges at multicast boundaries.
Can cause unexpected Auto-RP info filtering at
multicast boundaries.
Results in loss of Auto-RP info to other parts of
network.
Rule of Thumb:
Make sure Auto -RP Group-
Group-Ranges match exactly
any Multicast Boundary Ranges!
(i.e. dont use overlapping Auto-
Auto-RP group ranges.)
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 78

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 39
Administratively-Scoped Zones
Auto-RP Example with filter-autorp boundaries
Site A (HQ)

The filter-autorp option


prevents Site -Local RP
239.255.0.0/16
information from leaking out
Interface Serial0
ip multicast boundary 10 filter
filter-
- autorp of the Site.
access-list 10 deny 239.255.0.0 0.0.255.255 Interface Serial0
ip multicast boundary 10 filter
filter-
- autorp
access-list 10 permit any Border A
Site-Local Site-Local
S0 access-list 10 deny 239.255.0.0 0.0.255.255

S1
Boundaries Boundaries
access-list 10 permit any

Site B (LA) S0 Site C (ATL)

S0
Border B Border C

Interface Serial0
ip multicast boundary 10 filter -autorp
239.255.0.0/16 239.255.0.0/16
Interface Serial1
ip multicast boundary 10 filter -autorp

access-list 10 deny 239.255.0.0 0.0.255.255


access-list 10 permit any

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 79

Administratively-Scoped Zones
Auto-RP Example with filter-autorp boundaries
Site A (HQ)
interface Loopback0
Configuring Site -Local RPs
Site Local
ip address 192.168.10.2 255.255.255.255 Site Local and Mapping Agents at each
C-RP/MA C-RP/MA
ip pim send-r p- discovery scope 15
site.
ip pim send-r p- announce Loopback0 scope 15 group 20 (Only the LA site shown.)
access-list 20 permit 239.255.0.0 0.0.255.255

interface Loopback0
ip address 192.168.10.1 255.255.255.255
Border A
ip pim send-r p- discovery scope 15
S0 p- announce Loopback0 scope 15 group 20
S1

ip pim send-r

access-list 20 permit 239.255.0.0 0.0.255.255

Site B (LA) S0 Site C (ATL)


S0

Border B Border C

Site Local Site Local Site Local Site Local


C-RP/MA C-RP/MA C-RP/MA C-RP/MA

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 80

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 40
Administratively-Scoped Zones
Auto-RP Example with filter-autorp boundaries
Site A (HQ)

Site Local Site Local Still need Org-Local RP for


C-RP/MA C-RP/MA all non-Site Local Groups.

Org-Local Org-Local
C-RP C-RP

Org-Local C-RPs
Border A
(non-Site Local Groups)
S0

S1
Site B (LA) S0 Site C (ATL)

S0
Border B Border C

Site Local Site Local Site Local Site Local


C-RP/MA C-RP/MA C-RP/MA C-RP/MA

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 81

Administratively-Scoped Zones Example

Australia
North
ASIAPAC
China America

East Coast
Canada
India US

Japan
West Coast
US

Core

North EMEA
Region

Eastern
Region
Internet
South Region

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 82

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 41
Administratively-Scoped Zones Example
Level1: Site Scope
Australia
RP North
ASIAPAC
America
RPChina
RP
Canada
East Coast
India US
RP RP

Japan
West Coast
RP US

Core RP

RP
North EMEA
Region

Eastern
Region
Internet RP
Site Local Range: 239.255.x.x South Region

RP per Site RP

Reusable range

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 83

Administratively-Scoped Zones Example


Level2: Regional Scope
Australia
North
ASIAPAC
China America

East Coast
Canada
India US

Japan
West Coast
RP US

Core RP

North EMEA
Region

Eastern
Enterprise Regional Admin Scoped Range: Region
239.[192-254].x.x Internet
South Region
RP per Region
RP
Reusable range

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 84

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 42
Administratively-Scoped Zones Example
Level3: Enterprise Global Scope
Australia
North
ASIAPAC
China America

East Coast
Canada
India US

Japan
West Coast
RP US

Core RP

North EMEA
Region
Enterprise Global Administrative Scoped
Range: 239.[0-191].x.x Eastern
Region
Internet
Multiple Admin Scoped RPs (via MSDP full
South Region
mesh)
RP
Private Address Space within the
Enterprise, no Internet connectivity for this
range

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 85

Administratively-Scoped Zones Example


Level 4: Internet Global Scope
Australia
North
ASIAPAC
China America

East Coast
Canada
India US

Japan
West Coast
RP US

Core RP

North EMEA
Region

Eastern
Region
Internet

Global Sparse mode Address Space South Region

RP
224.0.[2-255].x 238.255.255.255
Multiple Global RPs (via MSDP full mesh)
MSDP connectivity to providers RPs

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 86

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 43
Advanced Multicast Engineering

Security
High Availability
Using Admin. Scoped Zones
Scaling Multicast Performance

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 87

Common Campus Design

Core Network

Stub Network Stub Network Stub Network

Users Servers Users

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 88

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 44
Non-RPF Performance Problem

Routers normally send Prunes in response to the


arrival of non-RPF traffic.
On P2P links, upstream sending router prunes flow.
Prunes can be overridden on Multi-access links:
By downstream routers on the link that need the traffic.
By member hosts on the link.
Result:
Certain multi-access network topologies result in non-
RPF traffic that cant be pruned.
Can result in high CPU loads on some routers.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 89

Non-RPF Performance Problem

Core Network Choke, Gasp,


Pant,
Wheeze!!

A B
High-rate Non-RPF Traffic
E0 E0

High-rate MPEG Video 10.1.1.0/24

Non
Non--RPF traffic may be dropped at Process-
Process-Switch level!
Depends on the platform. Occurs on 6500s and 8540s.

CPU load can sky-


sky-rocket!
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 90

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 45
6500/8540 Stub Network Solution

Core Network

A B
E0 E0

10.1.1.0/24

Interface
Interface E0E0
ip
ip access
access-group
-group 100
100 in
in
access-list
access-list 100
100 permit
permit ipip 10.1.1.0
10.1.1.0 0.0.0.255
0.0.0.255 any
any
access-list
access-list 100
100 permit
permit ipip 224.0.0.0
224.0.0.0 0.0.0.255
0.0.0.255 any
any
access-list
access-list 100
100 permit
permit ipip 224.0.1.0
224.0.1.0 0.0.0.255
0.0.0.255 any
any
access-list
access-list 100
100 deny
deny ip
ip any
any 224.0.0.0
224.0.0.0 15.255.255.255
15.255.255.255
access-list 100 permit ip any any
access-list 100 permit ip any any

ACL used to block non-RPF traffic


RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 91

6500/8540 Stub Network Solution

Allows multicast traffic to be sourced from network.


Permits router to receive critical protocol (OSPF, etc.) multicast.
Drops all remaining (non-RPF) multicast traffic.
Permits all other traffic.

Handled in ACL hardware by 6500/8540.


Use only on Stub networks!!!
Interface
Interface E0E0
ip
ip access
access-group
-group 100
100 in
in
access-list
access-list 100
100 permit
permit ipip 10.1.1.0
10.1.1.0 0.0.0.255
0.0.0.255 any
any
access-list
access-list 100
100 permit
permit ipip 224.0.0.0
224.0.0.0 0.0.0.255
0.0.0.255 any
any
access-list
access-list 100 permit ip 224.0.1.0 0.0.0.255 any
100 permit ip 224.0.1.0 0.0.0.255 any
access-list
access-list 100
100 deny
deny ip
ip any
any 224.0.0.0
224.0.0.0 15.255.255.255
15.255.255.255
access-list
access-list 100
100 permit
permit ipip any
any any
any

ACL implemented automatically by the mls ip multicast stub command in 12.1(?)E.


RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 92

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 46
Core Network Solution
Use p2p VLANs to avoid non-RPF problem.
Core Network

Separate VLANs

Stub Network Stub Network Stub Network

Users Servers Users

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 93

Multicast Router Performance

Performance Impacted by:


Packet Replication Loads
State Maintenance Loads
PIM Signaling Loads

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 94

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 47
Multicast Packet Replication

OIL size affects performance


Receiver
Gasp,
pant,
wheeze!!

Receiver

Receiver
Source
100 Packet Replications 100 Remote Sites
w/Receivers

Receiver
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 95

Software-based Packet Replication

Buffered I/O with 2 OIF


I/O I/O I/O
Buffer Buffer Buffer
Input Output Output
MAC Header MAC Header 2 MAC Header 1
Copy

Copy
Multicast Multicast Multicast
Packet Packet Packet

Unused Unused Unused

Arriving Allocate New Allocate New


Packet Buffer Buffer

CPU load increases dramatically. Performance suffers.


RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 96

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 48
Software-based Packet Replication

Particle I/O with 2 OIF


Particle
Buffers Particle Particle
Buffer Buffer
Input Output Output
MAC Header MAC Header 1 MAC Header 2

Multicast Allocate New Allocate New


Fragment 1 Particle Particle

Multicast Multicast
Packet Fragment 2
Reduced CPU load. Improved Performance.
Multicast
Fragment 3
Arriving
Packet

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 97

Software-based Packet Replication

Platforms that support Particle I/O


7200 Series Routers
7100 Series Routers
2600/3600/3700 Series Routers
VIP2 Line Cards
Local card replication only

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 98

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 49
Hardware-based Packet Replication

Cat 4000
Uses Special Replication Hardware
7600/Cat6500
Uses Special Replication Hardware
GSR
Method varies by line card type
ESR (10K)
Uses Pipeline processor

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 99

Multicast State Maintenance

CPU load factors


Must perform RPF recalculation every 5 seconds
Watch the total number of mroute table entries
Unicast route table size impacts RPF recalculation
Must maintain Interface and Entry Timers
Large OIL sizes significantly increase load
Timer processing optimized in IOS 12.?(?)
Greatly improves PIM scalability

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 100

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 50
Multicast State Maintenance

Memory load factors


(*, G) entry ~ 380 bytes + OIL size
(S, G) entry ~ 220 bytes + OIL size
Outgoing interface list (OIL) size
Each oil entry ~ 150 bytes
Memory consumption is typically not a factor

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 101

PIM Signaling

Signaling Loads
Register sending/receiving
During source start-up
Periodic Registers every 2 minutes
Periodic Joins/Prunes
Sent once per second
Topology changes
Can trigger large numbers of Join/Prune messages
Batch Join/Prune signaling added in IOS 12.?(?)
Significantly improves convergence time in networks
with large amounts of mroute state.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 102

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 51
PIM Protocol Extensions

Source Specific Multicast


Bidirectional (Bidir) PIM

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 103

Barriers to Multicast Deployment

Global Multicast Address Allocation


Dynamic Address Allocation
No adequate dynamic address allocation methods exist
SDR Doesnt scale
MASC Long ways off!
Static Address Allocation (GLOP)
Based on AS number.
Insufficient address space for large Content Providers.

Multicast Content Jammers


Undesirable sources on a multicast group.
Capt. Midnight sources bogus data/noise to group.
Can cause DoS attack by congesting low speed links.
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 104

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 52
Source Specific Multicast (SSM)

Uses Source Trees only.


Assumes One-to-Many model.
Most Internet multicast fits this model.
IP/TV also fits this model.
Hosts responsible for source discovery.
Typically via some out-of-band mechanism.
Web page, Content Server, etc.
Eliminates need for RP and Shared Trees.
Eliminates need for MSDP.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 105

SSM Overview

Hosts join a specific source within a group.


Content identified by specific (S,G) instead of (*,G).
Hosts responsible for learning (S,G) information.
Last-hop router sends (S,G) join toward source
Shared Tree is never Joined or used.
Eliminates possibility of content Jammers.
Only specified (S,G) flow is delivered to host.
Simplifies address allocation.
Dissimilar content sources can use same group without
fear of interfering with each other.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 106

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 53
SSM Example

Source Host learns of source, group/port


First-hop learns of source, group/port
First-hop send PIM (S,G) Join

A B C D
Out-of-band
PIM (S, G) Join source directory,
example: web server

IGMPv3 (S, G) Join E F

Receiver 1

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 107

SSM Example

Source Result: Shortest path tree rooted


at the source, with no shared tree.

A B C D
Out-of-band
source directory,
example: web server

E F

Receiver 1

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 108

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 54
SSM Configuration

Global command
ip pim ssm {default | <acl>}

Defines SSM address range


Default range = 232.0.0.0/8
Use ACL for other ranges
Prevents Shared Tree Creation
(*, G) Joins never sent or processed
PIM Registers never sent or processed
Available in IOS versions
12.1(5)T, 12.2, 12.0(15)S, 12.1(8)E

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 109

SSM Configuration of Legacy Routers

Only Last-Hop routers must be upgraded.


Core may be upgraded later.
Must insure no Shared Trees in SSM range.
Use ip pim accept-register at RP.
Prevents sources from registering in 232/8.
Use ip pim accept-rp on all routers.
Prevents (*,G) Joins from being processed for 232/8.
Use ip msdp sa-redistribute at RP.
Stops SA message origination in 232/8.
Use ip msdp sa-filter on MSDP peers.
Prevents forwarding of SA messages in 232/8.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 110

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 55
SSM Summary

Uses Source Trees only.


Hosts are responsible for source & group discovery.
Hosts must signal router which (S,G) to join.
Solves multicast address allocation problems.
Flows differentiated by both source and group.
Content providers can use same group ranges.
Since each (S,G) flow is unique.
Helps prevent certain DoS attacks
Bogus source traffic:
Cant consume network bandwidth.
Not received by host application.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 111

PIM Protocol Extensions

Source Specific Multicast


Bidirectional (Bidir) PIM

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 112

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 56
Multicast Application Categories

One-to-Many Applications
Video, TV, Radio, Concerts, Stock Ticker, etc.
Few-to-Few Applications
Small (<10 member) Video/Audio Conferences
Few-to-Many Applications
TIBCO RV Servers (Publishing)
Many-to-Many Applications
Stock Trading Floors, Gaming
Many-to-Few Applications
TIBCO RV Clients (Subscriptions)
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 113

Multicast Application Categories


PIM-SM (S, G) State

One-to-Many Applications
Single (S,G) entry
Few-to-Few Applications
Few (<10 typical) (S,G) entries
Few-to-Many Applications
Few (<10 typical) (S,G) entries
Many-to-Many Applications
Unlimited (S,G) entries
Many-to-Few Applications
Unlimited (S,G) entries
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 114

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 57
Multicast State Maintenance

CPU load factors


Must send/receive Registers
Must send periodic Joins/Prunes
Must perform RPF recalculation every 5 seconds
Watch the total number of mroute table entries
Unicast route table size impacts RPF recalculation

Memory load factors


(*, G) entry ~ 380 bytes + OIL size
(S, G) entry ~ 220 bytes + OIL size
Outgoing interface list (OIL) size
Each oil entry ~ 150 bytes

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 115

Many-to-Any State Problem

Creates huge amounts of (S,G) state


State maintenance workloads skyrocket
High OIL fanouts make the problem worse
Router performance begins to suffer
Using Shared-Trees only
Provides some (S,G) state reduction
Results in (S,G) state only along SPT to RP
Frequently still too much (S,G) state
Need a solution that only uses (*,G) state

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 116

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 58
Bidirectional (Bidir) PIM

Idea:
Use the same tree for traffic from sources
towards RP and from RP to receivers
Benefits:
Less state in routers
Only (*, G) state is used
Source traffic follows the Shared Tree
Flows up the Shared Tree to reach the RP.
Flows down the Shared Tree to reach all other
receivers.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 117

Bidirectional (Bidir) PIM

Bidirectional Shared-Trees
Violates current (*,G) RPF rules
Traffic often accepted on outgoing interfaces.
Care must be taken to avoid multicast loops
Requires a Designated Forwarder (DF)
Responsible for forwarding traffic up Shared
Tree
DFs will accept data on the interfaces in their OIL.
Then send it out all other interfaces. (Including the IIF.)

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 118

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 59
Bidirectional (Bidir) PIM

Designated Forwarders (DF)


On each link the router with the best path
to the RP is elected to be the DF
Note: Designated Routers (DR) are not
used for bidir groups
The DF is responsible for forwarding traffic
upstream towards the RP
No special treatment is required for local
sources

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 119

Bidirectional PIM Example

RP Sender/
Receiver Receiver

Shared Tree

Receiver

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 120

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 60
Bidirectional PIM Example

RP Sender/
Receiver Receiver

Source Traffic forwarded


bidirectionally using (*,G) state.

Shared Tree
Source Traffic
Receiver

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 121

Configuring Bidir PIM


(Auto-RP Example)

Define Candidate RP and groups / modes it is


willing to serve

ip pim send-rp-announce Loopback0 scope 10 group-list 45 bidir


ip pim send-rp-announce Loopback1 scope 10 group-list 46
! Two loopbacks needed due to a nature of ACLs (permit, deny)
ip pim send-rp-discovery scope 10

access-list 45 permit 224.0.0.0 0.255.255.255


access-list 45 permit 227.0.0.0 0.255.255.255
! 224/8 and 227/8 will be PIM Bidir groups
access-list 45 deny 225.0.0.0 0.255.255.255
! 225/8 will be a PIM Dense Mode group

access-list 46 permit 226.0.0.0 0.255.255.255


! 226/8 will be a PIM Sparse Mode group

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 122

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 61
Bidir PIM Phantom RP

RP
E0 (DF)

E0 E0

E F
E1 (DF) E1 (DF)

E0 E0 E0 E0

A B C D
E1 (DF) E1 (DF) E1 (DF) E1 (DF)

Source Receiver 2 Receiver 1

Question: Does a Bidir RP even have to physically exist?


Answer: No. It can just be a phantom address.
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 123

Bidir PIM Phantom RP

E0 (DF)

E0 E0

E F
E1 (DF) E1 (DF)

E0 E0 E0 E0

A B C D
E1 (DF) E1 (DF) E1 (DF) E1 (DF)

(*, 224.1.1.1), 00:32:20/00:02:59, RP 172.16.21.1, flags: BP


Bidir-Upstream: Ethernet0, RPF nbr 172.16.7.1
Outgoing Receiver
interface2 list:
Source Receiver 1
Ethernet0, Bidir-Upstream/Sparse-Dense, 00:32:20/00:00:00

Router E forwards traffic onto core LAN segment.

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 124

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 62
Bidir PIM Phantom RP

E0 (DF)

E0 E0

E F
E1 (DF) E1 (DF)

E0 E0 E0 E0

A B C D
E1 (DF) E1 (DF) E1 (DF) E1 (DF)

(*, 224.1.1.1), 00:00:49/00:02:41, RP 172.16.21.1, flags: B


Bidir-Upstream: Ethernet0, RPF nbr 172.16.1.1
Outgoing interface list:
Source Receiver
Ethernet0, 2
Bidir-Upstream/Sparse-Dense, 00:00:49/00:00:00 Receiver 1
Ethernet1, Forward/Sparse-Dense, 00:00:49/00:02:41

Router F forwards traffic on down the Shared Tree ala normal PIM-SM.
RP doesnt even have to physically exist.
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 125

Phantom RP on Point-to-Point Core


Static Route Method

P S
RP: 1.1.1.1

ip multicast-routing ip multicast-routing

interface Loopback0 interface Loopback0


ip address 11.0.0.1 255.255.255.255 ip address 11.0.0.2 255.255.255.255
ip pim sparse-mode ip pim sparse-mode

router ospf 11 router ospf 11


redistribute static subnets redistribute static subnets

ip route 1.1.1.1 255.255.255.255 Loopback0 ip route 1.1.1.0 255.255.255.254 Loopback0

ip pim bidir-enable ip pim bidir-enable


ip pim rp-address 1.1.1.1 bidir ip pim rp-address 1.1.1.1 bidir

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 126

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 63
Phantom RP on Point-to-Point Core
Netmask Method

P S
RP: 1.1.1.2

ip multicast -routing ip multicast -routing


! !
interface Loopback0 interface Loopback0
ip address 1.1.1.1 255.255.255.252 ip address 1.1.1.1 255.255.255.248
ip pim sparse-mode ip pim sparse-mode
ip ospf network point-
point- to
to-- point ip ospf network point-
point- to
to-- point
! !
router ospf 11 router ospf 11
network 1.1.1.0 0.0.0.3 area 0 network 1.1.1.0 0.0.0.7 area 0
network 10.1.1.0 0.0.0.255 area 0 network 10.1.1.0 0.0.0.255 area 0
network 10.1.2.0 0.0.0.255 area 0 network 10.1.2.0 0.0.0.255 area 0
! !
ip pim bidir-enable ip pim bidir-enable
ip pim rp-address 1.1.1.1 ip pim rp-address 1.1.1.1
ip pim rp-address 1.1.1.2 bidir ip pim rp-address 1.1.1.2 bidir
RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 127

Bidir PIMSummary

Drastically reduces network mroute state


Eliminates ALL (S,G) state in the network
SPTs between sources to RP eliminated
Source traffic flows both up and down
Shared Tree
Allows Many-to-Any applications to scale
Permits virtually an unlimited number of sources

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 128

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 64
Recommended Reading

Developing IP Multicast
Networks, Volume I
ISBN: 1578700779

Available on-site at the Cisco Company Store

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 129

Please Complete Your


Evaluation Form

Session RST-2051

RST-2051-rev1 2003, Cisco Systems, Inc. All rights reserved. 130

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 65
Session Number
Presentation_ID 2003, Cisco Systems, Inc. All rights reserved. 131

Copyright 1998, Cisco Systems, Inc. All rights reserved. Printed in USA.
0863_04F9_c2.scr 66

Das könnte Ihnen auch gefallen