PIM Boundaries using MSDP

Load multicast.multi.domain.init.cfg

#IOS-XE
config replace flash:multicast.multi.domain.init.cfg
 
#IOS-XR
configure
load bootflash:multicast.multi.domain.init.cfg
commit replace
y

The group of routers circled on the left should be a PIM sub-domain. Traffic for multicast group 239.10.0.0/24 should not leak out this domain.

Configure R6 and R9 as anycast RPs using BSR. Use MSDP to prevent multicast traffic for 239.10.0.0/24 from leaking outside the sub-domain.

Answer

#R6, R9
int Lo0
 ip pim sparse-mode
int lo100
 ip add 1.0.0.100 255.255.255.255
 ip ospf 1 area 0
 ip pim sparse-mode
!
ip pim bsr-candidate lo0
ip pim rp-candidate lo100

#R6
ip msdp peer 1.0.0.9 connect-source lo0
ip msdp originator-id lo0
ip msdp redistribute list REDIST_GROUPS
!
ip access-list ext REDIST_GROUPS
 deny ip any 239.10.0.0 0.0.0.255
 permit ip any any

#R9
ip msdp peer 1.0.0.6 connect-source lo0
ip msdp originator-id lo0

#XR4
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0.524
   cost 100
  interface GigabitEthernet0/0/0/0.594
   cost 100

Explanation

Now that we are familiar with MSDP, we can revisit our “intra-IGP multi-domain PIM” problem. PIM domains, for ASM, are essentially bound by a group of routers sharing the same RP mapping information. In previous solutions, we attempted to block the propagation of RP information between our PIM sub domains. This prevents multicast traffic from working for certain group ranges between domains.

Now that we are familiar with MSDP, we can implement this functionality in a more elegant way. All RPs in the entire topology simply run Anycast RP. This provides HA for the RP. In addition, MSDP must be used for Anycast RP. We can filter which groups we send SA messages for, to enforce domain boundaries. Whatever groups an RP sends SA messages for become inter-domain multicast capable. Any groups the RP does not send SA messages for bounds the multicast traffic to that local domain.

For this to work correctly, all routers in a subdomain must use a single RP. For this reason, we increase the cost of XR4’s links to the other domain, so that routers such as R7 use R6 as the closest Anycast RP node.

#XR4
router ospf 1
 area 0
  interface GigabitEthernet0/0/0/0.524
   cost 100
  interface GigabitEthernet0/0/0/0.594
   cost 100

Next, besides implementing normal Anycast RP configuration, we just instruct R6 to only send SAs for groups other than the groups which must stay local to the subdomain.

#R6
ip msdp redistribute list REDIST_GROUPS
!
ip access-list ext REDIST_GROUPS
 deny ip any 239.10.0.0 0.0.0.255
 permit ip any any

On R2 and R4, we join groups 239.10.0.1 and 239.20.0.1:

#R2
ip multicast-routing dist
!
int gi2.525
 ip pim sparse-mode
 ip igmp join-group 239.10.0.1
 ip igmp join-group 239.20.0.1

#R4
ip multicast-routing dist
!
int GigabitEthernet2.543
 ip pim sparse-mode
 ip igmp join-group 239.10.0.1
 ip igmp join-group 239.20.0.1

Now R1 pings these groups. Traffic for 239.10.0.1 does not generate an SA on R6, due to the ACL associated with the redistribute command. R9 never learns of the (R1, 239.10.0.1) entry and R4 never receives the traffic:

R1 then pings 239.20.0.1. R6 does send an SA for this (S, G) entry to R9. R9 is then able to join the (S, G), and R4 receives the traffic: