Cisco IOS Cookbook, 2nd Edition

Filtering PIM Neighbors

Problem

You want to prevent your router from accepting PIM packets from another device.

Solution

In this example, we will configure a neighbor filter on Router1’s FastEthernet interface, which it uses to connect to a foreign router called Router2:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#ip multicast-routing
Router1(config)#interface FastEthernet0/0
Router1(config-if)#ip address 192.168.1.1 255.255.255.0
Router1(config-if)#ip pim sparse-mode
Router1(config-if)#ip pim neighbor-filter 18
Router1(config-if)#exit
Router1(config)#access-list 18 deny any
Router1(config)#end
Router1#

Then, on the foreign router, we must configure an igmp helper-address:

Router2#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router2(config)#ip multicast-routing
Router2(config)#interface FastEthernet0/0
Router2(config-if)#ip address 192.168.1.2 255.255.255.0
Router2(config-if)#ip pim dense-mode
Router2(config-if)#ip igmp helper-address 192.168.1.1
Router2(config-if)#end
Router2#

Discussion

There are two main reasons for configuring a PIM neighbor filter. The first and most obvious reason is security. If you don’t control all of the routers on a network segment, but you want to maintain administrative control over your multicast routing trees, you might want to prevent the foreign devices from taking part in PIM. In particular, since PIM elects a Designated Router (DR) to handle multicast forwarding ...