-
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide, 12.1(22)EA5
-
Index
-
Preface
-
Overview
-
Using the Command-Line Interface
-
Configuring Catalyst 2955 Switch Alarms
-
Assigning the Switch IP Address and Default Gateway
-
Configuring IE2100 CNS Agents
-
Clustering Switches
-
Administering the Switch
-
Configuring Switch-Based Authentication
-
Configuring IEEE 802.1x Port-Based Authentication
-
Configuring Interface Characteristics
-
Configuring SmartPort Macros
-
Configuring LRE
-
Configuring STP
-
Configuring MSTP
-
Configuring Optional Spanning-Tree Features
-
Configuring VLANs
-
Configuring VTP
-
Configuring Voice VLAN
-
Configuring DHCP Features
-
Configuring IGMP Snooping and MVR
-
Configuring Port-Based Traffic Control
-
Configuring UDLD
-
Configuring CDP
-
Configuring SPAN and RSPAN
-
Configuring RMON
-
Configuring System Message Logging
-
Configuring SNMP
-
Configuring Network Security with ACLs
-
Configuring QoS
-
Configuring EtherChannels
-
Troubleshooting
-
Supported MIBs
-
Working with the Cisco IOS File System, Configuration Files, and Software Images
-
Table Of Contents
Configuring IGMP Snooping and MVR
IGMP Snooping Querier Configuration Guidelines and Restrictions
Default IGMP Snooping Configuration
Enabling or Disabling IGMP Snooping
Configuring a Multicast Router Port
Configuring a Host Statically to Join a Group
Enabling IGMP Immediate-Leave Processing
Configuring the IGMP Leave Timer
Disabling IGMP Report Suppression
Disabling IP Multicast-Source-Only Learning
Configuring the IGMP Snooping Querier
Displaying IGMP Snooping Information
Understanding Multicast VLAN Registration
Using MVR in a Multicast Television Application
MVR Configuration Guidelines and Limitations
Configuring MVR Global Parameters
Configuring IGMP Filtering and Throttling
Default IGMP Filtering and Throttling Configuration
Setting the Maximum Number of IGMP Groups
Configuring the IGMP Throttling Action
Displaying IGMP Filtering and Throttling Configuration
Configuring IGMP Snooping and MVR
This chapter describes how to configure Internet Group Management Protocol (IGMP) snooping on your Catalyst 2950 or Catalyst 2955 switch, including an application of local IGMP snooping, Multicast VLAN Registration (MVR). It also includes procedures for controlling multicast group membership by using IGMP filtering and procedures for configuring the IGMP throttling action.
Note
For complete syntax and usage information for the commands used in this chapter, see the switch command reference for this release and the Cisco IOS Release Network Protocols Command Reference, Part 1, for Cisco IOS Release 12.1
This chapter consists of these sections:
•
•
•
•
Note
Understanding IGMP Snooping
Layer 2 switches can use IGMP snooping to constrain the flooding of multicast traffic by dynamically configuring Layer 2 interfaces so that multicast traffic is forwarded to only those interfaces associated with IP multicast devices. As the name implies, IGMP snooping requires the LAN switch to snoop on the IGMP transmissions between the host and the router and to keep track of multicast groups and member ports. When the switch receives an IGMP report from a host for a particular multicast group, the switch adds the host port number to the forwarding table entry; when it receives an IGMP Leave Group message from a host, it removes the host port from the table entry. It also periodically deletes entries if it does not receive IGMP membership reports from the multicast clients.
Note
The multicast router sends out periodic IGMP general queries to all VLANs. When IGMP snooping is enabled, the switch responds to the router queries with only one join request per MAC multicast group, and the switch creates one entry per VLAN in the Layer 2 forwarding table for each MAC group from which it receives an IGMP join request. All hosts interested in this multicast traffic send join requests and are added to the forwarding table entry.
Layer 2 multicast groups learned through IGMP snooping are dynamic. However, you can statically configure MAC multicast groups by using the ip igmp snooping vlan static global configuration command. If you specify group membership for a multicast group address statically, your setting supersedes any automatic manipulation by IGMP snooping. Multicast group membership lists can consist of both user-defined and IGMP snooping-learned settings.
You can configure an IGMP snooping querier to support IGMP snooping in subnets without multicast interfaces because the multicast traffic does not need to be routed. For more information about the IGMP snooping querier, see the "Configuring the IGMP Snooping Querier" section.
If a port spanning-tree, a port group, or a VLAN ID change occurs, the IGMP snooping-learned multicast groups from this port on the VLAN are deleted.
The switches support a maximum of 255 IP multicast groups.
These sections describe characteristics of IGMP snooping on the switch:
•
•
IGMP Versions
The switch supports IGMP version 1, IGMP version 2, and IGMP version 3. These versions are interoperable on the switch. For example, if IGMP snooping is enabled on an IGMPv2 switch and the switch receives an IGMPv3 report from a host, the switch can forward the IGMPv3 report to the multicast router.
Note
An IGMPv3 switch supports Basic IGMPv3 Snooping Support (BISS), which includes support for the snooping features on IGMPv1 and IGMPv2 switches and for IGMPv3 membership report messages. BISS constrains the flooding of multicast traffic when your network includes IGMPv3 hosts. It constrains traffic to approximately the same set of ports as the IGMP snooping feature on IGMPv2 or IGMPv1 hosts.
Note
An IGMPv3 switch can receive messages from and forward messages to a device running the Source Specific Multicast (SSM) feature. For more information, see the "Configuring IP Multicast Layer 3 Switching" chapter in the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide, Cisco IOS Release 12.1(12c)EW at this URL:
Joining a Multicast Group
When a host connected to the switch wants to join an IP multicast group, it sends an unsolicited IGMP join message, specifying the IP multicast group to join. Alternatively, when the switch receives a general query from the router, it forwards the query to all ports in the VLAN. Hosts wanting to join the multicast group respond by sending a join message to the switch. The switch CPU creates a multicast forwarding-table entry for the group if it is not already present. The CPU also adds the interface where the join message was received to the forwarding-table entry. The host associated with that interface receives multicast traffic for that multicast group. See Figure 20-1.
Figure 20-1 Initial IGMP Join Message
Router A sends a general query to the switch, which forwards the query to ports 2 through 5, all members of the same VLAN. Host 1 wants to join multicast group 224.1.2.3 and multicasts an IGMP membership report (IGMP join message) to the group with the equivalent MAC destination address of 0x0100.5E01.0203. When the CPU receives the IGMP report multicast by Host 1, the CPU uses the information in the IGMP report to set up a forwarding-table entry, as shown in Table 20-1, that includes the port numbers of Host 1, the router, and the switch internal CPU.
Table 20-1 IGMP Snooping Forwarding Table
0100.5exx.xxxx
IGMP
0
0100.5e01.0203
!IGMP
1, 2
Note that the switch hardware can distinguish IGMP information packets from other packets for the multicast group.
•
•
If another host (for example, Host 4) sends an unsolicited IGMP join message for the same group (Figure 20-2), the CPU receives that message and adds the port number of Host 4 to the forwarding table as shown in Table 20-2. Note that because the forwarding table directs IGMP messages to only the CPU, the message is not flooded to other ports on the switch. Any known multicast traffic is forwarded to the group and not to the CPU. Any unknown multicast traffic is flooded to the VLAN and sent to the CPU until it becomes known.
Figure 20-2 Second Host Joining a Multicast Group
Table 20-2 Updated IGMP Snooping Forwarding Table
0100.5exx.xxxx
IGMP
0
0100.5e01.0203
!IGMP
1, 2, 5
Leaving a Multicast Group
The router sends periodic multicast general queries and the switch forwards these queries through all ports in the VLAN. Interested hosts respond to the queries. If at least one host in the VLAN wishes to receive multicast traffic, the router continues forwarding the multicast traffic to the VLAN. The switch forwards multicast group traffic to only those hosts listed in the forwarding table for that Layer 2 multicast group.
When hosts want to leave a multicast group, they can either silently leave, or they can send a leave message. When the switch receives a leave message from a host, it sends out a MAC-based general query to determine if any other devices connected to that interface are interested in traffic for the specific multicast group. The switch then updates the forwarding table for that MAC group so that only those hosts interested in receiving multicast traffic for the group are listed in the forwarding table. If the router receives no reports from a VLAN, it removes the group for the VLAN from its IGMP cache.
Immediate-Leave Processing
Immediate Leave is only supported with IGMP version 2 hosts.
The switch uses IGMP snooping Immediate-Leave processing to remove from the forwarding table an interface that sends a leave message without the switch sending MAC-based general queries to the interface. The VLAN interface is pruned from the multicast tree for the multicast group specified in the original leave message. Immediate-Leave processing ensures optimal bandwidth management for all hosts on a switched network, even when multiple multicast groups are simultaneously in use.
Note
IGMP Configurable-Leave Timer
In Cisco IOS Release 12.1(22)EA2 and earlier, the IGMP snooping leave time was fixed at 5 seconds. If membership reports were not received by the switch before the query response time of the query expired, a port was removed from the multicast group membership. However, some applications require a leave latency of less than 5 seconds.
In Cisco IOS Release 12.1(22)EA3 and later, you can configure the time that the switch waits after sending a group-specific query to determine if hosts are still interested in a specific multicast group. The IGMP leave response time can be configured from 100 to 5000 milliseconds. The timer can be set either globally or on a per-VLAN basis. The VLAN configuration of the leave time overrides the global configuration.
IGMP Leave Timer Guidelines
Follows these guidelines when configuring the IGMP leave timer:
•
•
•
•
•
IGMP Report Suppression
Note
The switch uses IGMP report suppression to forward only one IGMP report per multicast router query to multicast devices. When IGMP router suppression is enabled (the default), the switch sends the first IGMP report from all hosts for a group to all the multicast routers. The switch does not send the remaining IGMP reports for the group to the multicast routers. This feature prevents duplicate reports from being sent to the multicast devices.
If the multicast router query includes requests only for IGMPv1 and IGMPv2 reports, the switch forwards only the first IGMPv1 or IGMPv2 report from all hosts for a group to all the multicast routers.
If the multicast router query also includes requests for IGMPv3 reports, the switch forwards all IGMPv1, IGMPv2, and IGMPv3 reports for a group to the multicast devices.
If you disable IGMP report suppression, all IGMP reports are forwarded to the multicast routers.
IGMP Snooping Querier Configuration Guidelines and Restrictions
Follow these guidelines and restrictions when configuring the IGMP snooping querier on the Catalyst 2955 switches:
•
•
•
•
•
•
•
–
–
Source-Only Networks
In a source-only network, switch ports are connected to multicast source ports and multicast router ports. The switch ports are not connected to hosts that send IGMP join or leave messages.
The switch learns about IP multicast groups from the IP multicast data stream by using the source-only learning method. The switch forwards traffic only to the multicast router ports.
The default learning method is IP multicast-source-only learning. You can disable IP multicast-source-only learning by using the no ip igmp snooping source-only-learning global configuration command.
In addition to IGMP query packets, the switch also uses Protocol-Independent Multicast protocol version 2 (PIMv2) packets for multicast router discovery. The packets are sent to the switch CPU, which can result in a occasional high CPU traffic. You can disable multicast router discovery by PIMv2 packets by using the no ip igmp snooping mrouter learn pim v2 global configuration command. This command only works when you also disable source-only learning on the switch by using the no ip igmp snooping source-only-learning global configuration command.
By default, the switch ages out forwarding-table entries that were learned by the source-only learning method and that are not in use. If the aging time is too long or is disabled, the forwarding table is filled with unused entries that the switch learned by using source-only learning or by using the IGMP join messages. When the switch receives traffic for new IP multicast groups, it floods the packet to all ports in the same VLAN. This unnecessary flooding can impact switch performance.
If aging is disabled and you want to delete multicast addresses that the switch learned by using source-only learning, re-enable aging of the forwarding-table entries. The switch can now age out the multicast addresses that were learned by the source-only learning method and are not in use.
Configuring IGMP Snooping
IGMP snooping allows switches to examine IGMP packets and make forwarding decisions based on their content.
These sections describe how to configure IGMP snooping:
•
•
•
•
•
•
•
•
•
Default IGMP Snooping Configuration
Table 20-3 shows the default IGMP snooping configuration.
Enabling or Disabling IGMP Snooping
By default, IGMP snooping is globally enabled on the switch. When globally enabled or disabled, it is also enabled or disabled in all existing VLAN interfaces. IGMP snooping is by default enabled on all VLANs, but can be enabled and disabled on a per-VLAN basis.
Global IGMP snooping overrides the VLAN IGMP snooping. If global snooping is disabled, you cannot enable VLAN snooping. If global snooping is enabled, you can enable or disable VLAN snooping.
Beginning in privileged EXEC mode, follow these steps to globally enable IGMP snooping on the switch:
To globally disable IGMP snooping on all VLAN interfaces, use the no ip igmp snooping global configuration command.
Beginning in privileged EXEC mode, follow these steps to enable IGMP snooping on a VLAN interface:
To disable IGMP snooping on a VLAN interface, use the no ip igmp snooping vlan vlan-id global configuration command for the specified VLAN number.
Setting the Snooping Method
Multicast-capable router ports are added to the forwarding table for every Layer 2 multicast entry. The switch learns of such ports through one of these methods:
•
•
•
You can configure the switch either to snoop on IGMP queries and PIM/DVMRP packets or to listen to CGMP self-join or proxy-join packets. By default, the switch snoops on PIM/DVMRP packets on all VLANs. To learn of multicast router ports through only CGMP packets, use the ip igmp snooping vlan vlan-id mrouter learn cgmp global configuration command. When this command is entered, the router listens to only CGMP self-join and CGMP proxy-join packets and no other CGMP packets. To learn of multicast router ports through only PIM-DVMRP packets, use the ip igmp snooping vlan vlan-id mrouter learn pim-dvmrp global configuration command.
Beginning in privileged EXEC mode, follow these steps to alter the method in which a VLAN interface dynamically accesses a multicast router:
This example shows how to configure IGMP snooping to use CGMP packets as the learning method:
Switch# configure terminalSwitch(config)# ip igmp snooping vlan 1 mrouter learn cgmpSwitch(config)# endTo return to the default learning method, use the no ip igmp snooping vlan vlan-id mrouter learn cgmp global configuration command.
Configuring a Multicast Router Port
To add a multicast router port (add a static connection to a multicast router), use the ip igmp snooping vlan mrouter global configuration command on the switch.
Beginning in privileged EXEC mode, follow these steps to enable a static connection to a multicast router:
To remove a multicast router port from the VLAN, use the no ip igmp snooping vlan vlan-id mrouter interface interface-id global configuration command.
This example shows how to enable a static connection to a multicast router and verify the configuration:
Switch# configure terminalSwitch(config)# ip igmp snooping vlan 200 mrouter interface gigabitethernet0/1Switch(config)# endConfiguring a Host Statically to Join a Group
Hosts or Layer 2 ports normally join multicast groups dynamically, but you can also statically configure a host on an interface.
Beginning in privileged EXEC mode, follow these steps to add a Layer 2 port as a member of a multicast group:
To remove the Layer 2 port from the multicast group, use the no ip igmp snooping vlan vlan-id static mac-address interface interface-id global configuration command.
This example shows how to statically configure a host on an interface and verify the configuration:
Switch# configure terminalSwitch(config)# ip igmp snooping vlan 1 static 0100.5e00.0203 interface gigabitethernet0/1Switch(config)# endEnabling IGMP Immediate-Leave Processing
When you enable IGMP Immediate-Leave processing, the switch immediately removes a port when it detects an IGMP version 2 leave message on that port. You should use the Immediate-Leave feature only when there is a single receiver present on every port in the VLAN.
Immediate Leave is supported with only IGMP version 2 hosts.
Beginning in privileged EXEC mode, follow these steps to enable IGMP Immediate-Leave processing:
To disable IGMP Immediate-Leave on a VLAN, use the no ip igmp snooping vlan vlan-id immediate-leave global configuration command.
This example shows how to enable IGMP immediate-leave processing on VLAN 130:
Switch# configure terminalSwitch(config)# ip igmp snooping vlan 130 immediate-leaveSwitch(config)# endConfiguring the IGMP Leave Timer
Beginning in privileged EXEC mode, follow these steps to enable the IGMP configurable-leave timer:
Use the no ip igmp snooping last-member-query-interval global configuration command to globally reset the IGMP leave timer to the default setting (1000 milliseconds).
Use the no ip igmp snooping vlan vlan-id last-member-query-interval global configuration command to remove the configured IGMP leave-time setting from the specified VLAN.
Disabling IGMP Report Suppression
IGMP report suppression is enabled by default. When it is enabled, the switch forwards only one IGMP report per multicast router query. When report suppression is disabled, all IGMP reports are forwarded to the multicast routers.
Note
Beginning in privileged EXEC mode, follow these steps to disable IGMP report suppression:
To re-enable IGMP report suppression, use the ip igmp snooping report-suppression global configuration command.
Disabling IP Multicast-Source-Only Learning
The IP multicast-source-only learning method is enabled by default. The switch learns the IP multicast group from the IP multicast data stream and only forwards traffic to the multicast router ports.
If IP multicast-source-only learning is disabled by using the no ip igmp snooping source-only-learning global configuration command, the switch floods unknown multicast traffic to the VLAN and sends the traffic to the CPU until the traffic becomes known. When the switch receives an IGMP report from a host for a particular multicast group, the switch forwards traffic from this multicast group only to the multicast router ports.
To disable multicast router discovery by PIMv2 packets, you should also enter the no ip igmp snooping mrouter learn pim v2 global configuration command.
Note
Beginning in privileged EXEC mode, follow these steps to disable IP multicast-source-only learning:
To enable IP multicast-source-only learning, use the ip igmp snooping source-only-learning global configuration command. To enable PIM v2 multicast router discovery, use the p igmp snooping mrouter learn pim v2 global configuration command.
This example shows how to disable IP multicast-source-only learning and PIM v2 multicast router discovery:
Switch# configure terminalSwitch(config)# no ip igmp snooping source-only-learningSwitch(config)# no ip igmp snooping mrouter learn pim v2Switch(config)# endConfiguring the Aging Time
You can set the aging time for forwarding-table entries that the switch learns by using the IP multicast-source-only learning method.
Beginning in privileged EXEC mode, follow these steps to configure the aging time:
To disable the aging of the forwarding table entries, enter the ip igmp snooping source-only-learning age-timer 0 global configuration command.
If you disable source-only learning by using the no ip igmp snooping source-only learning global configuration command and the aging time is enabled, it has no effect on the switch.
Configuring the IGMP Snooping Querier
To enable the IGMP snooping querier feature in a VLAN, follow these steps:
This example shows how to set the IGMP snooping querier source address to 10.0.0.64 and to verify the configuration:
Switch# configure terminalSwitch(config)# ip igmp snooping querier 10.0.0.64Switch(config)# end
This example shows how to set the IGMP snooping querier maximum response time to 25 seconds and to verify the configuration:
Switch# configure terminalSwitch(config)# ip igmp snooping querier query-interval 25Switch(config)# endThis example shows how to set the IGMP snooping querier timeout to 60 seconds and to verify the configuration:
Switch# configure terminalSwitch(config)# ip igmp snooping querier timeout expiry 60Switch(config)# endThis example shows how to set the IGMP snooping querier feature to version 2 and to verify the configuration:
Switch# configure terminalSwitch(config)# no ip igmp snooping querier version 2Switch(config)# endDisplaying IGMP Snooping Information
You can display IGMP snooping information for dynamically learned and statically configured router ports and VLAN interfaces. You can also display MAC address multicast entries for a VLAN configured for IGMP snooping.
To display IGMP snooping information, use one or more of the privileged EXEC commands in Table 20-4. For more information about the keywords and options in these commands, see the command reference for this release. For examples of output from the commands in Table 20-4, see the command reference for this release.
Understanding Multicast VLAN Registration
Multicast VLAN Registration (MVR) is designed for applications using wide-scale deployment of multicast traffic across an Ethernet ring-based service provider network (for example, the broadcast of multiple television channels over a service-provider network). MVR allows a subscriber on a port to subscribe and unsubscribe to a multicast stream on the network-wide multicast VLAN. It allows the single multicast VLAN to be shared in the network while subscribers remain in separate VLANs. MVR provides the ability to continuously send multicast streams in the multicast VLAN, but to isolate the streams from the subscriber VLANs for bandwidth and security reasons.
MVR assumes that subscriber ports subscribe and unsubscribe (join and leave) these multicast streams by sending out IGMP join and leave messages. These messages can originate from an IGMP version-2-compatible host with an Ethernet connection. Although MVR operates on the underlying mechanism of IGMP snooping, the two features operate independently of each other. One can be enabled or disabled without affecting the behavior of the other feature. However, if IGMP snooping and MVR are both enabled, MVR reacts only to join and leave messages from multicast groups configured under MVR. Join and leave messages from all other multicast groups are managed by IGMP snooping.
The switch CPU identifies the MVR IP multicast streams and their associated MAC addresses in the switch forwarding table, intercepts the IGMP messages, and modifies the forwarding table to include or remove the subscriber as a receiver of the multicast stream, even though the receivers might be in a different VLAN from the source. This forwarding behavior selectively allows traffic to cross between different VLANs.
The switch has these modes of MVR operation: dynamic and compatible.
•
•
Note
Using MVR in a Multicast Television Application
In a multicast television application, a PC or a television with a set-top box can receive the multicast stream. Multiple set-top boxes or PCs can be connected to one subscriber port, which is a switch port configured as an MVR receiver port. Figure 20-3 is an example configuration. DHCP assigns an IP address to the set-top box or the PC. When a subscriber selects a channel, the set-top box or PC sends an IGMP report to Switch A to join the appropriate multicast. If the IGMP report matches one of the configured multicast MAC addresses, the switch CPU modifies the hardware address table to include this receiver port and VLAN as a forwarding destination of the specified multicast stream when it is received from the multicast VLAN. Uplink ports that send and receive multicast data to and from the multicast VLAN are called MVR source ports.
When a subscriber changes channels or turns off the television, the set-top box sends an IGMP leave message for the multicast stream. The switch CPU sends an IGMP group-specific query through the receiver port VLAN. If there is another set-top box in the VLAN still subscribing to this group, that set-top box must respond within the maximum response time. If the CPU does not receive a response, it eliminates the receiver port as a forwarding destination for this group.
If the Immediate-Leave feature is enabled on a receiver port, the port leaves a multicast group more quickly. Without Immediate Leave, when the switch receives an IGMP leave message from a subscriber on a receiver port, it sends out an IGMP query on that port and waits for IGMP group membership reports. If no reports are received in a configured time period, the receiver port is removed from multicast group membership. With Immediate Leave, an IGMP query is not sent from the receiver port on which the IGMP leave was received. As soon as the leave message is received, the receiver port is removed from multicast group membership, which speeds up leave latency. Enable the Immediate Leave feature only on receiver ports to which a single receiver device is connected.
Figure 20-3 Multicast VLAN Registration Example
MVR eliminates the need to duplicate television-channel multicast traffic for subscribers in each VLAN. Multicast traffic for all channels is only sent around the VLAN trunk once—only on the multicast VLAN. Although the IGMP leave and join message in the VLAN to which the subscriber port is assigned. These messages dynamically register for streams of multicast traffic in the multicast VLAN on the Layer 3 device. The access layer switch (Switch A) modifies the forwarding behavior to allow the traffic to be forwarded from the multicast VLAN to the subscriber port in a different VLAN, selectively allowing traffic to cross between two VLANs.
IGMP reports are sent to the same MAC addresses as the multicast data. The Switch A CPU must capture all IGMP join and leave messages from receiver ports and forward them to the multicast VLAN of the source (uplink) port.
Configuring MVR
These sections include basic MVR configuration information:
•
•
Default MVR Configuration
Table 20-5 shows the default MVR configuration.
MVR Configuration Guidelines and Limitations
Follow these guidelines when configuring MVR:
•
•
•
•
Note
Configuring MVR Global Parameters
You do not need to set the optional MVR parameters if you choose to use the default settings. If you do want to change the default parameters (except for the MVR VLAN), you must first enable MVR.
Beginning in privileged EXEC mode, follow these steps to configure MVR parameters:
