To participate in forwarding and inspecting IP multicast traffic, a firewall can coexist with multicast routers running Protocol-Independent Multicast (PIM) sparse mode.
A firewall can operate as an IGMP proxy agent, also called a stub router. For all multicast-related operations, the firewall acts on behalf of the recipients. IGMP requests from recipient hosts on one firewall interface are intercepted, inspected, and relayed to multicast routers on another firewall interface.
Beginning with PIX 7.x, a firewall can also be configured to act as a PIM router so that it communicates with other PIM routers to build a complete multicast distribution tree.
After recipients join multicast groups, the firewall can intercept, inspect, ...