|
CCIE™ Challenge Question
Which of the following are ways to implement multicast on the PIX?
(Choose 3)
| a) |
multicast interface inside
igmp forward interface outside
multicast interface outside
|
| b) |
Use an access list to permit all IP traffic to addresses ranging from 224.0.0.0 to 239.255.255.255. Apply the access list to the outside interface. |
| c) |
The PIX cannot handle multicast traffic. |
| d) |
The traffic can be encapsulated in a GRE tunnel by routers and passed through the PIX. |
| e) |
multicast interface inside
multicast interface outside
mroute 0.0.0.0 0.0.0.0 inside 224.0.0.0 240.0.0.0 outside
|
Answer
| a) |
multicast interface inside
igmp forward interface outside
multicast interface outside
|
| d) |
The traffic can be encapsulated in a GRE tunnel by routers and passed through the PIX. |
| e) |
multicast interface inside
multicast interface outside
mroute 0.0.0.0 0.0.0.0 inside 224.0.0.0 240.0.0.0 outside
|
Explanation
There are two modes of multicast transmission: from more secure to less secure (interface); and from less secure to more secure.
From less secure to more secure requires the PIX to forward IGMP messages from clients on the more secure side to the multicast source on the less secure side. Thus, the PIX must be configured to pass the IGMP messages from the inside to the outside. This will automatically permit the multicast stream into the client. Choice A shows the minimum configuration for this.
Multicast transmission from more secure to less secure interfaces does not require any IGMP forwarding. It has only to forward the multicast stream. Downstream routers will pick up the multicast stream and will handle the IGMP with the end clients. The PIX must know where the multicast is coming from, and to which interface it must be forwarded. Choice E shows a correct configuration. The mroute command permits multicast traffic from any source on the inside interface and forwards any valid multicast address (from 224.0.0.0 to 239.255.255.255) to the outside interface.
An access list can be configured for the address ranges used for multicast, but multicast will not work. The router will not be able to handle the IGMP traffic, nor will it have the multicast route. Answer C is incorrect.
Before version 6.2, the only way to pass multicast through a PIX was to encapsulate it in a GRE tunnel terminated on routers and to pass this tunnel through the PIX.
[5392]
|
