Access control configuration is the configuration of access groups and weighted group limits.
The role of access groups in IGMP v2/v3 message filteringis to permit or deny host membership requests for multicast groups
(*,G) and multicast source groups (S,G). This is required to provide black-and-white list access to IPTV channel packages.
Weighted group limits restrict the number of IGMP v2/v3 groups, in which the maximum number of concurrently allowed multicast
channels can be configured on a per EFP- and per PW-basis.
IGMP Snooping Access Groups
Although Layer-3 IGMP routing also uses the igmp access-group
command in support of access groups, the support is not the same in Layer-2 IGMP,
because the Layer-3 IGMP routing access group feature does not support source
Access groups are specified using an extended IP access list referenced in an IGMP snooping profile that you attach to a bridge
domain or a port.
A port-level access group overrides any bridge domain-level access group.
The access-group command instructs IGMP snooping to apply the
specified access list filter to received membership reports. By default, no access list
Changes made to the access-list referenced in the profile (or a replacement of the access-list referenced in the igmp snooping
profile) will immediately result in filtering the incoming igmp group reports and the existing group states accordingly, without
the need for a detach-reattach of the igmp snooping profile in the bridge-domain, each time such a change is made.
IGMP Snooping Group Weighting
To limit the number of IGMP v2/v3 groups, in which the maximum number of concurrently allowed multicast channels must be configurable
on a per EFP-basis and per PW-basis, configure group weighting.
IGMP snooping limits the membership on a bridge port to a configured maximum, but extends the feature to support IGMPv3 source
groups and to allow different weights to be assigned to individual groups or source groups. This enables the IPTV provider,
for example, to associate standard and high- definition IPTV streams, as appropriate, to specific subscribers.
This feature does not limit the actual multicast bandwidth that may be transmitted on a port. Rather, it limits the number
of IGMP groups and source-groups, of which a port can be a member. It is the responsibility of the IPTV operator to configure
subscriber membership requests to the appropriate multicast flows.
The group policy command, which is under igmp-snooping-profile
configuration mode, instructs IGMP snooping to use the specified route policy to
determine the weight contributed by a new <*,G> or <S,G> membership request.
The default behavior is for there to be no group weight configured.
The group limit command specifies the group limit of the port.
No new group or source group is accepted if its contributed weight would cause this
limit to be exceeded. If a group limit is configured (without group policy
configuration), a <S/*,G> group state will have a default weight of 1 attributed
By default, each group or source-group contributes a weight of 1 towards the group limit. Different weights can be assigned
to groups or source groups using the group policy command.
The group limit policy configuration is based on these conditions:
Group weight values for <*,G> and <S,G> membership are configured in a Route Policy, that is included in an igmp snooping
profile attached to a BD or port.
Port level weight policy overrides any bridge domain level policy, if group-limit is set and route-policy is configured.
If there is no policy configured, each group weight is counted equally and is equal to 1.
If policy has been configured, all matching groups get weight of 1 and un-matched groups have 0 weight.