Adding a multicast filter in your Cisco switch

Updated by Bryan Jones

Scope

When connecting Cisco switches used for Livewire to other network switches sometimes it is useful to be able to create a filter that specifically blocks certain address ranges. This document will provide you guidance for creating filters.

Description

Make sure you know what you are blocking. The entire multicast range goes from 224.0.0.0 all the way to 239.255.255.255. If you block the entire range, you could block certain multicast addresses that are used for things other than Livewire. As one example, mDNS (or multicast dns) which is used by Apply Bonjour could block the discovery of other things (like printers).

In this example, we're only going to block addresses used by Livewire that are in the Organization-Local Scope range as defined by the IANA Multicast Address Space Registry.

Specifically the range of addresses 239.192.0.0 to 239.193.255.255

Configuration

Adding a Filter

  1. Using PuTTy or another terminal program make a connection to the CLI (Command Line Interface) of your Cisco switch.
This is normally done using Telnet but could also be using SSH or Serial connections.
  1. Enter privileged mode using the enable command followed by your enable password. The prompt will change from > to a # sign when in privileged mode.
BryansCiscoSw>enable
Password: 
BryansCiscoSw#
  1. Enter terminal config mode using the config t command. The hostname will be appended with (config) mode when you are in this mode.
BryansCiscoSw#config t
Enter configuration commands, one per line.  End with CNTL/Z.
BryansCiscoSw(config)#

  1. Enter the following commands
BryansCiscoSw(config)#ip igmp profile 10
BryansCiscoSw(config-igmp-profile)#
We're using 10 for a profile number. If this is your first filter you can use profile 1. Profile IDs can be any number from 1 to more than four million.
BryansCiscoSw(config-igmp-profile)#range 239.192.0.0 239.193.255.255     
BryansCiscoSw(config-igmp-profile)#
BryansCiscoSw(config-igmp-profile)#deny
BryansCiscoSw(config-igmp-profile)#
BryansCiscoSw(config-igmp-profile)#exit
BryansCiscoSw(config)#
BryansCiscoSw(config)#end
BryansCiscoSw#

Check your filter

  1. From the command prompt, enter the command show run to show the current configuration. The configuration will be displayed one page at a time. Use the spacebar to display the next page.
  2. Near the top of the page, in the IGMP section, look for the appearance of your new filter and confirm the range setting is correct.

If you have made a mistake, re-enter the terminal configuration mode (conf t). You can remove filter profiles by using the no command in front of the command. For example, to remove the filter profile we just created, enter the command;

BryansCiscoSw(config)#no ip igmp profile 10
BryansCiscoSw(config)#

When you send the show run command you will see that the profile is gone.

Apply the filter to your network ports

Once you have created the filter it must be applied to the ports where filtering is required. In our example, we're going to apply this filter to a port that connects to an Office network where we do not want any Multicast traffic.

  1. Enter the terminal config mode by using theconfig t command. You will know you are in this mode by the (config) indication next to the hostname.
BryansCiscoSw#config t
Enter configuration commands, one per line.  End with CNTL/Z.
BryansCiscoSw(config)#
  1. Specify the port you want to configure by using the int command. This will vary from switch to switch. In our example, we're configuring gigabit ethernet port 4. This is referred to by cisco as gi0/4
BryansCiscoSw(config)#int gi0/4
BryansCiscoSw(config-if)#

If there are any questions about the names of your interfaces they are shown when you issue the show run command. Show run displays the current configuration on each port. Here is the example from this configuration.
Interface GigabitEthernet0/4 is abbreviated by gi0/4 in this case
  1. Apply the filter profile to this port
BryansCiscoSw(config-if)#ip igmp filter 10
BryansCiscoSw(config-if)#
  1. Exit port configuration mode
BryansCiscoSw(config-if)#exit
BryansCiscoSw(config)#
  1. Exit global config mode
BryansCiscoSw(config)#exit
BryansCiscoSw#

Check your port configuration

Send the show run command again. Make sure that your filter is shown in the port configuration as shown here.

Finally, save your work

Once everything is configured, you must write the configuration back to the switch so that if it ever reboots it has this same configuration after the restart. If you do not save your work the configuration will revert when you restart.

  1. From the command prompt, send the wr command (wr is short for write).
BryansCiscoSw#wr    
Building configuration...
[OK]
BryansCiscoSw#

Let us know how we can help

If you have further questions on this topic or have ideas about improving this document, please contact us.

How did we do?