IPv6 multicast by design allows any host in the network to become a receiver or a source for a multicast group. Therefore,
multicast access control is needed to control multicast traffic in the network. Access control functionality consists mainly
of source access control and accounting, receiver access control and accounting, and provisioning of this access control mechanism.
Multicast access control provides an interface between multicast and authentication, authorization, and accounting (AAA)
for provisioning, authorizing, and accounting at the last-hop device, receiver access control functions in multicast, and
group or channel disabling capability in multicast.
When you deploy a new multicast service environment, it is necessary to add user authentication and provide a user profile
download on a per-interface basis. The use of AAA and IPv6 multicast supports user authentication and downloading of the user
profile in a multicast environment.
The event that triggers the download of a multicast access-control profile from the RADIUS server to the access device is
arrival of an MLD join on the access device. When this event occurs, a user can cause the authorization cache to time out
and request download periodically or use an appropriate multicast clear command to trigger a new download in case of profile
Accounting occurs via RADIUS accounting. Start and stop accounting records are sent to the RADIUS server from the access
device. In order for you to track resource consumption on a per-stream basis, these accounting records provide information
about the multicast source and group. The start record is sent when the last-hop device receives a new MLD report, and the
stop record is sent upon MLD leave or if the group or channel is deleted for any reason.