Deploying IP Multicast

Transcription

1 Deploying IP Multicast Session RST _04F9_c2.scr 1

2 Agenda Geekometer Basic Multicast Engineering Advanced Multicast Engineering 3 Basic Multicast Engineering PIM Configuration Steps Which Mode: Sparse or Dense? RP Engineering _04F9_c2.scr 2

3 PIM Configuration Steps Enable Multicast Routing on every router Configure every interface for PIM Configure the RP Using Auto-RP or BSR Configure certain routers as Candidate RP(s) All other routers automatically learn elected RP Anycast/Static RP addressing RP address must be configured on every router Note: Anycast RP requires MSDP 5 Configure PIM on Every Interface Classic Partial Multicast Cloud Mistake #1 src T1/E1 line has best metric to source no ip pim dense-mode T1/E1 56K/64K ip pim dense-mode X We ll just use the spare 56K line for the IP Multicast traffic and not the T1. Network Engineer rcvr RPF Failure!!!!! _04F9_c2.scr 3

4 Configure PIM on Every Router Classic Partial Multicast Cloud Mistake #2 src Highest next-hop IP address used for RPF when equal cost paths exist. RPF Failure!!!!! Multicast Enabled A /24.2 B Multicast Disabled X E0 We ll just keep multicast traffic off of certain routers in the network. Network Engineer E1 C rcvr 7 Basic Multicast Engineering PIM Configuration Steps Which Mode: Sparse or Dense? RP Engineering _04F9_c2.scr 4

5 Which Mode Sparse or Dense Dense mode Flood and Prune behavior very inefficient Can cause problems in certain network topologies Creates (S, G) state in EVERY router Even when there are no receivers for the traffic Complex Assert mechanism Mixed control and data planes Results in (S, G) state in every router in the network Can result in non-deterministic topological behavior Read: It can black-hole traffic and/or melt down your network! Primarily usage: Testing a router s performance in the lab 9 Which Mode Sparse or Dense Sparse mode Must configure a Rendezvous Point (RP) Very efficient Uses Explicit Join model Traffic only flows to where it s needed Separated control and data planes Router state only created along flow paths Deterministic topological behavior Scales well Works for both sparsely or densely populated networks _04F9_c2.scr 5

6 Which Mode Sparse or Dense CONCLUSION Sparse mode Good! Dense mode Bad! Source: The Caveman s Guide to IP Multicast, 2000, R. Davis 11 Group Mode vs. Interface Mode Group & Interface mode are independent. Interface Mode Determines how the interface operates when sending/receiving multicast traffic. Group Mode Determines whether the group is Sparse or Dense _04F9_c2.scr 6

7 Group Mode Group mode is controlled by local RP info Local RP Information Stored in the Group-to-RP Mapping Cache May be statically configured or learned via Auto-RP or BSR If RP info exists, Group = Sparse If RP info does not exist, Group = Dense Mode Changes are automatic. i.e. if RP info is lost, Group falls back to Dense. 13 Configuring Interface Interface Mode Configuration Commands Enables multicast forwarding on the interface. Controls the interface s mode of operation. ip pim dense-mode Interface mode is set to Dense mode operation. ip pim sparse-mode Interface mode is set to Sparse mode operation. ip pim sparse-dense-mode Interface mode is determined by the Group mode. If Group is Dense, interface operates in Dense mode. If Group is Sparse, interface operates in Sparse mode _04F9_c2.scr 7

8 Basic Multicast Engineering PIM Configuration Steps Which Mode: Sparse or Dense? RP Engineering 15 RP Engineering RP Configuration Methods General RP Recommendations Avoiding DM Fallback Using Multiple Group Ranges _04F9_c2.scr 8

9 RP Configuration Methods Static Auto-RP BSR Anycast-RP s 17 Static RP s Hard-coded RP address When used, must be configured on every router All routers must have the same RP address RP fail-over not possible Exception: If Anycast RPs are used. (More on that later.) Group can never fall back into Dense mode _04F9_c2.scr 9

10 Auto-RP Overview Announce C-RP Announce Announce C A Announce MA B Announce MA Announce Announce D C-RP Announce RP-Announcements multicast to the Cisco Announce ( ) group Announce 19 Auto-RP Overview C-RP Discovery Discovery C A Discovery Discovery MA Discovery Discovery B MA Discovery Discovery D C-RP RP-Discoveries multicast to the Cisco Discovery ( ) group Discovery _04F9_c2.scr 10

11 BSR Overview BSR Election Process G BSR Msg BSR Msg C-BSR D BSR Msg BSR Msg BSR Msg BSR Msg C-BSR A BSR Msg BSR Msg BSR Msg BSR Msg C-BSR F BSR Msg BSR Msg B C BSR Msgs BSR Msgs Flooded Hop-by-Hop E 21 BSR Overview Highest Priority C-BSR is elected as BSR G D BSR A F B C E _04F9_c2.scr 11

12 BSR Overview G D C-RP Advertisement (unicast) BSR A C-RP Advertisement (unicast) F C-RP B C C-RP E 23 BSR Overview G D BSR Msg BSR Msg BSR A BSR Msg BSR Msg F C-RP B C C-RP BSR Msgs BSR Msgs containing RP-set Flooded Hop-by-Hop E _04F9_c2.scr 12

13 Anycast RP Overview Src Src RP1 X A SA MSDP SA RP2 B Rec Rec Rec Rec 25 Anycast RP Overview Src Src RP1 X A RP2 B Rec Rec Rec Rec _04F9_c2.scr 13

14 RP Engineering RP Configuration Methods General RP Recommendations Avoiding DM Fallback Using Multiple Group Ranges 27 General RP Recommendations Use Anycast RP s: When network must connect to Internet or When rapid RP failover is critical Pros Fastest RP Convergence method Required when connecting to Internet Cons Requires more configuration Requires use of MSDP between RP s _04F9_c2.scr 14

15 General RP Recommendations Use Auto-RP When minimum configuration is desired and/or When maximum flexibility is desired Pros Most flexible method Easiest to maintain Cons Increased RP Failover times vs Anycast Special care needed to avoid DM Fallback Some methods greatly increase configuration 29 General RP Recommendations Use BSR: When Static/Anycast RP s cannot be used and When maximum interoperability is needed Pros Interoperates with all Vendors Cons Increased RP Failover times vs Anycast Special care needed to avoid DM Fallback Some methods greatly increase configuration Not as field-proven as other methods _04F9_c2.scr 15

16 Dense Mode Fallback Caused by loss of local RP information. Entry in Group-to-RP mapping cache times out. Can happen when: All C-RP s fail. Auto-RP/BSR mechanism fails. Generally a result of network congestion. Group is switched over to Dense mode. Dense mode state is created in the network. Dense mode flooding begins if interfaces configured as ip pim sparse-dense-mode. 31 Dense Mode Fallback Avoiding Dense Mode Fallback To always guarantee Sparse mode operation (and avoid falling back to Dense mode), make sure that every router always knows of an RP for every group _04F9_c2.scr 16

17 Avoiding DM Fallback Current Workaround Define an RP-of-last-resort Configure as a Static RP on every router Will only be used if all Candidate-RP s fail Can be a dummy address or local Loopback Recommendation: Use local Loopback on each router MUST use ACL to avoid breaking Auto-RP! ip pim rp-address <RP-of-last-resort> 10 access-list 10 deny access-list 10 deny access-list 10 permit any 33 Avoiding DM Flooding Future New IOS global command ip pim autorp-listener Added support for Auto-RP Environments Modifies interface behavior Interface always uses DM for Auto-RP groups Permits use of ip pim sparse-mode interfaces and Auto-RP. Prevents DM Flooding When ip pim sparse-mode used on interfaces. Does not prevent DM Fallback! Does not prevent DM Fallback! Available soon _04F9_c2.scr 17

18 Avoiding DM Flooding Future Deploying ip pim autorp-listener Must be configured on every router. Use RP-of-last-resort on older IOS versions until upgraded Assign local Loopback as RP-of-last-resort on each router. Example ip pim rp-address <local_loopback> 10 access-list 10 deny access-list 10 deny access-list 10 permit any 35 Avoiding DM Fallback Future New IOS global command no ip pim dm-fallback Totally prevents DM Fallback!! No DM Flooding since all state remains in SM Default RP Address = [nonexistent] Used if all RP s fail. Results in loss of Shared Tree. All SPT s remain active. Available soon _04F9_c2.scr 18

19 RP Engineering RP Configuration Methods General RP Recommendations Avoiding DM Fallback Using Multiple Group Ranges 37 Using Multiple Group Ranges Definition: Different RPs for different group ranges Often used to: Directly connect an RP to group sources Assumes Few-to-many application model Split up RP workload over multiple RP s Provide different Shared Tree topologies Used with spt-threshold = infinity Caveats: Try to avoid overlapping group ranges Can cause unexpected RP election results _04F9_c2.scr 19

20 Using Multiple Group Ranges A C PIM Sparse Mode RP/Mapping Agent LO0: RP/Mapping Agent LO0: B D ip pim send-rp-announce Loopback0 scope 16 group-list 20 ip pim send-rp-discovery Loopback0 scope 16! access-list 20 permit access-list 20 permit ip pim send-rp-announce Loopback0 scope 16 group-list 20 ip pim send-rp-discovery Loopback0 scope 16! access-list 20 permit access-list 20 permit C-RP/Mapping Agent Configs 39 Using Multiple Group Ranges Rtr-B#show ip pim rp mapping PIM Group-to-RP Mappings This system is an RP (Auto-RP) This system is an RP-mapping agent (Loopback0) PIM Sparse Mode RP/Mapping Agent LO0: Group(s) /4 RP (R5), v2v1 Info source: (R5), via Auto-RP Uptime: 01:05:03, expires: 00:02:27 RP (R2), v2v1 Info source: (R2), via Auto-RP Uptime: 01:05:11, expires: 00:02:43 Group(s) /8 RP (R5), v2v1 Info source: (R5), via Auto-RP Uptime: 00:17:29, expires: 00:02:29 Group(s) /16 RP (R2), v2v1 Info source: (R2), via Auto-RP Uptime: 00:56:18, expires: 00:02:41 A C RP/Mapping Agent LO0: B D Mapping Agent s Group-to-RP mapping cache contains all learned C-RP s ordered by Group, Mask length, and C-RP address _04F9_c2.scr 20

21 Using Multiple Group Ranges Rtr-B#show ip pim rp mapping PIM Group-to-RP Mappings This system is an RP (Auto-RP) This system is an RP-mapping agent (Loopback0) A C PIM Sparse Mode RP/Mapping Agent LO0: Group(s) /4 RP (R5), v2v1 Info source: (R5), via Auto-RP Uptime: 01:05:03, expires: 00:02:27 RP (R2), v2v1 Info source: (R2), via Auto-RP Uptime: 01:05:11, expires: 00:02:43 Group(s) /8 RP (R5), v2v1 Info source: (R5), via Auto-RP Uptime: 00:17:29, expires: 00:02:29 Group(s) /16 RP (R2), v2v1 Info source: (R2), via Auto-RP Uptime: 00:56:18, expires: 00:02:41 RP/Mapping Agent LO0: B D Mapping Agent advertises elected RP s in Discovery Messages Note: Elected RP is always listed as first C-RP for a Group Range. 41 Using Multiple Group Ranges RP/Mapping Agent LO0: A PIM Sparse Mode B Rtr-D#sh ip pim rp map PIM Group-to-RP Mappings C RP/Mapping Agent LO0: D Group(s) /4 RP (Rtr-C), v2v1 Info source: (Rtr-C), via Auto-RP Uptime: 01:00:14, expires: 00:02:25 Group(s) /8 RP (Rtr-C), v2v1 Info source: (Rtr-C), via Auto-RP Uptime: 00:12:40, expires: 00:02:24 Group(s) /16 RP (Rtr-B), v2v1 Info source: (Rtr-C), via Auto-RP Uptime: 00:51:28, expires: 00:02:24 Resulting Group-to-RP Mapping Cache in all non-ma routers (Notice that only elected RP s are contained the Group-to-RP mapping cache in non-ma routers.) _04F9_c2.scr 21

22 Using Multiple Group Ranges RP/Mapping Agent LO0: A PIM Sparse Mode B Join Rtr-D#sh ip pim rp map PIM Group-to-RP Mappings C RP/Mapping Agent LO0: D Group(s) /4 RP (Rtr-C), v2v1 Info source: (Rtr-C), via Auto-RP Uptime: 01:00:14, expires: 00:02:25 Group(s) /8 RP (Rtr-C), v2v1 Info source: (Rtr-C), via Auto-RP Uptime: 00:12:40, expires: 00:02:24 Group(s) /16 RP (Rtr-B), v2v1 Info source: (Rtr-C), via Auto-RP Uptime: 00:51:28, expires: 00:02:24 Which entry will the router use to determine RP address? This one? (It has the highest RP address.) Or this one? (It has the longest mask.) 43 Using Multiple Group Ranges RP/Mapping Agent LO0: A PIM Sparse Mode B Join Rtr-D#sh ip pim rp map PIM Group-to-RP Mappings C RP/Mapping Agent LO0: D Group(s) /4 RP (Rtr-C), v2v1 Info source: (Rtr-C), via Auto-RP Uptime: 01:00:14, expires: 00:02:25 Group(s) /8 RP (Rtr-C), v2v1 Info source: (Rtr-C), via Auto-RP Uptime: 00:12:40, expires: 00:02:24 Group(s) /16 RP (Rtr-B), v2v1 Info source: (Rtr-C), via Auto-RP Uptime: 00:51:28, expires: 00:02:24 Answer: Router uses longest match to find matching entry in the Group-to-RP mapping cache. Moral: Avoid overlapping group ranges to reduce the chances of incorrect RP selection _04F9_c2.scr 22

23 Overlapping Group Ranges Local Scope / Local Scope /16 Organization-Local Scope /14 Global Scope /4 Avoid!!! Can result in confusion and misconfiguration Organization-Local Scope /14 Use non-overlapping overlapping group ranges. Especially when using Admin. Scoping. Global Scope / / / / / /8 45 Overlapping Group Ranges access-list 10 permit Local Scope /16 access-list 20 permit access-list 30 permit access-list 30 permit access-list 30 permit access-list 30 permit access-list 30 permit access-list 30 permit Organization-Local Scope /14 Use non-overlapping overlapping group ranges. Especially when using Admin. Scoping. Global Scope / / / / / / _04F9_c2.scr 23

24 Overlapping Group Ranges Avoiding Overlapping Group Ranges Can t use deny clause in C-RP ACL s Implies Dense-mode Override ip pimsend-rp-announce loopback0 scope 16 group-list 10 access-list 10 deny access-list 10 permit Must only use permit clauses ip pimsend-rp-announce loopback0 scope 16 group-list 10 access-list 10 permit access-list 10 permit access-list 10 permit Agenda Basic Multicast Engineering Advanced Multicast Engineering _04F9_c2.scr 24

25 Advanced Multicast Engineering Security High Availability Using Admin. Scoped Zones Scaling Multicast Performance 49 Controlling Receivers IGMP Access-Group Approach No filter (default) VLAN101 interface VLAN100 ip igmp access-group IPMC-ACL ip access-list standard IPMC-ACL permit deny any VLAN100 Permit VT Stream Deny Executive Meeting Stream IP/TV This is micro-management of IP Multicast traffic!!! _04F9_c2.scr 25

26 Controlling Source Registration Global command ip pim accept-register [list <acl>] [route-map <map>] Used on RP to filter incoming Register messages Filter on Source address alone (Simple ACL) Filter on (S, G) pair (Extended ACL) May use route-map to specify what to filter Filter by AS-PATH if (m)bgp is in use. Helps prevents unwanted sources from sending First hop router blocks traffic from reaching net Note: Traffic can still flow under certain situations 51 Controlling Source Registration RP RP configured to only accept Registers from specific source. ip pim accept-register list 10 access-list 10 permit _04F9_c2.scr 26

27 Controlling Source Registration RP Source Traffic Unwanted Sender Register First-hop Register-Stop Unwanted source traffic hits first-hop router. First-hop router creates (S,G) state and sends Register. RP rejects Register, sends back a Register-Stop. 53 Controlling Source Registration Weaknesses in accept-register usage. RP Traffic will flow on local subnet where source resides. Unwanted Sender Traffic will flow from first-hop router down any branches of the Shared Tree. Shared Tree Receiver First-hop Results when (*,G) OIL is copied to (S,G) OIL at first-hop router. Causes (S,G) traffic to flow down all interfaces in (*,G) OIL of first-hop router. Fundamental limitation of PIM protocol. Receiver Receiver _04F9_c2.scr 27

28 Disabling Entire Group Ranges Accept-Register Method ip pim accept-register group-list 10 access-list 10 deny access-list 10 permit any Pros Only configured on RP(s) Cons Shared Trees and (*,G) state still created. Results in unwanted (*,G) PIM Control Traffic. Source traffic can still flow. (See previous section on Accept-Register) 55 Disabling Entire Group Ranges Garbage Can RP Method Concept: Separate RP for disabled groups Could be non-existant router Blackholes all Registers and Joins Implementation: Define separate RP for disabled groups Use Auto-RP, BSR or Static RP definition Disable RP functionality on Garbage Can RP Use accept-rp command on GC RP to deny it from serving as RP for the disabled group range _04F9_c2.scr 28

29 Disabling Entire Group Ranges Garbage Can RP Method Pros: Few if any. Cons: Periodic Registers still sent to GC RP Periodic Joins still sent to GC RP Has same source issues as Accept-Register Source traffic can still flow under certain conditions. Adds significant complexity to network 57 Disabling Entire Group Ranges Local Loopback RP Method Concept: Only Auto-RP-learned groups are authorized. All other groups are considered unauthorized. Implementation: Define local Loopback as RP for unauthorized groups on each router. ip pim rp-address <local_loopback> 10 access-list 10 permit Note: The permit clause defines the unauthorized group _04F9_c2.scr 29

30 Disabling Entire Group Ranges Local Loopback RP Method Operation: Each router serves as RP for unauthorized groups. Collapses PIM-SM domain of unauthorized groups down to the local router. Unauthorized group traffic cannot flow beyond local router. 59 Disabling Entire Group Ranges Local Loopback RP Method Pros: No PIM control traffic sent. Local router is RP so no Registers/Joins are sent. No additional workload on local router. First-hop routers always have to create state anyway. Can also serve as RP-of-last-resort Solving DM Fallback problem at the same time. Cons: Must be configured on every router. Local sources can still send to local receivers _04F9_c2.scr 30

31 Disabling Entire Group Ranges Recommendation Use Local Loopback RP Method Effectively disables unauthorized group traffic. Can also serve as RP-of-last-resort ip pim rp-address <local_loopback> 10 access-list 10 deny access-list 10 deny access-list 10 permit any 61 Disabling Entire Group Ranges Future New no ip pim dm-fallback command Undefined (via Auto-RP or BSR) groups default to an RP address of Effectively disables any group unlearned groups. Available soon _04F9_c2.scr 31

32 Preventing RP-Spoofing DoS Attacks Global command ip pim rp-announce-filter rp-list <acl> [group-list <acl>] rp-list <acl> Specifies from which routers C-RP Announcements are accepted. group-list <acl> Specifies which groups in the C-RP Announcement are accepted. If not specified, defaults to deny all groups Use on Mapping Agents to filter out bogus C-RP s Some protection from RP-Spoofing denial-of-service attacks Multiple commands may be configured as needed 63 Preventing RP-Spoofing DoS Attacks Use ip pim rp-announce-filter on RP Use me as your RP Use me as your RP Mapping Agent ip pim rp-announce-filter rp-list 11 group-list 12 access-list 11 permit access-list 12 permit access-list 12 permit access-list 12 permit access-list 12 permit access-list 12 deny access-list 12 permit !IP address of Permitted RP!Permit MoH!Permit Low Stream!Permit Medium Stream!Permit High Stream!Deny remaining Admin. Scoped range!permit Link Local/Reserved Addr. Using this configuration allows the router to accept RP announcements from only the RP in access-list 11 for group ranges described in access-list _04F9_c2.scr 32

33 Advanced Multicast Engineering Security High Availability Using Admin. Scoped Zones Scaling Multicast Performance 65 Auto-RP Failover RP failover time Function of Holdtime in C-RP Announcement Holdtime = 3 x <rp-announce-interval> Default < rp-announce-interval> = 60 seconds Default Failover ~ 3 minutes Minimizing impact of RP failure Use SPTs to reduce impact Traffic on SPTs not affected by RP failure Immediate switch to SPTs is on by default New and/or bursty sources still a problem _04F9_c2.scr 33

34 Tuning Auto-RP Failover Tune Candidate RPs Use interval clause to control failover times ip pim send-rp-announce <intfc> scope <ttl> [group-list acl] [interval <seconds>] Allows rp-announce-interval to be adjusted Smaller intervals = Faster RP failover Smaller intervals increase amount Auto-RP traffic Increase is usually insignificant Total RP failover time reduced Min. failover ~ 3 seconds Consider using Anycast RP for faster failover 67 DR Failover A B.2 (DR) /24.1 Rtr-B>show ip pim neighbor PIM Neighbor Table Neighbor Address Interface Uptime Expires Mode Ethernet0 4d22h 00:01:18 Sparse-Dense (DR) Depends on neighbor expiration time Expiration Time sent in PIM query messages Expiration time = 3 x <query-interval> Default <query-interval> = 30 seconds DR Failover ~ 90 seconds (worst case) by default _04F9_c2.scr 34

35 DR Failover Tune PIM query interval Use interface configuration command ip pim query-interval <period> [msec] Default <period> = seconds msec keyword available beginning with 12.1(11b)E Permits DR failover to be adjusted Min. DR failover ~ 3 seconds (worst case) Smaller intervals increase PIM query traffic Increase is usually insignificant 69 Advanced Multicast Engineering Security High Availability Using Admin. Scoped Zones Scaling Multicast Performance _04F9_c2.scr 35

36 Administratively-Scoped Zones Used to limit: High-BW sources to local site Control sensitive multicast traffic Simple scoped zone example: /16 = (Site) Local Scope /14 = Organization-Local Scope = Global scope (Internet) zone High-BW sources use Site-Local scope Low-Med. BW sources use Org.-Local scope Internet-wide sources use Global scope 71 Administratively-Scoped Zones Site A (HQ) /16 Site-Local Boundaries block high-rate /16 traffic from going out the WAN links. Site-Local Boundaries Border A S0 S1 S0 Site-Local Boundaries Site B (LA) S0 Border B Border C Site C (ATL) / / _04F9_c2.scr 36

37 Administratively-Scoped Zones Site A (HQ) Interface Serial0 ip multicast boundary /16 Site-Local Boundaries block high-rate /16 traffic from going out the WAN links. access-list 10 deny access-list 10 permit any Border A Site-Local Boundaries S0 Interface Serial0 ip multicast boundary 10 Site-Local Boundaries Site B (LA) S0 Border B S1 S0 access-list 10 deny access-list 10 permit any Border C Site C (ATL) Interface Serial0 ip multicast boundary / /16 Interface Serial1 ip multicast boundary 10 access-list 10 deny access-list 10 permit any 73 Administratively-Scoped Zones Auto-RP Example Site A (HQ) Site Local C-RP/MA Site Local C-RP/MA Each site needs its own set of Site Local C-RP s and Mapping Agent(s). Border A S0 Site B (LA) S0 Border B S1 S0 Border C Site C (ATL) Site Local C-RP/MA Site Local C-RP/MA Site Local C-RP/MA Site Local C-RP/MA _04F9_c2.scr 37

38 Administratively-Scoped Zones Auto-RP Example Site A (HQ) Site Local C-RP/MA Site Local C-RP/MA Problem:Site-Local RP info can leak into other sites and cause wrong C-RP to be elected. Border A S0 Site B (LA) S0 Border B S1 S0 Border C Site C (ATL) Site Local C-RP/MA Site Local C-RP/MA Site Local C-RP/MA Site Local C-RP/MA 75 Administratively-Scoped Zones Preventing Auto-RP Info Leakage Multicast Boundary Command ip multicast boundary <acl> [filter-autorp] New filter-autorp option Filters contents of Auto-RP packets Filters both Announcement and Discovery messages C-RP entries that fail <acl> are removed from packet Prevents C-RP information from leaking in/out of scoped zone. Greatly simplifies Admin. Scoped Zone support in Auto-RP. Available in 12.0(22)S, 12.2(12) _04F9_c2.scr 38

39 Administratively-Scoped Zones Preventing Auto-RP Info Leakage How filter-autorp option works: For each RP Entry in Auto-RP packet: If group-range in RP-Entry intersects any denied group-range in the Multicast Boundary ACL, delete RP Entry from Auto-RP packet. If resulting Auto-RP packet is non-empty, forward across multicast boundary. 77 Administratively-Scoped Zones Preventing Auto-RP Info Leakage Using Multicast Boundary filter-autorp Avoid Auto-RP Group-Range Overlaps Overlapping ranges can intersect denied ranges at multicast boundaries. Can cause unexpected Auto-RP info filtering at multicast boundaries. Results in loss of Auto-RP info to other parts of network. Rule of Thumb: Make sure Auto-RP Group-Ranges match exactly any Multicast Boundary Ranges! (i.e. don t use overlapping Auto-RP group ranges.) _04F9_c2.scr 39

40 Administratively-Scoped Zones Auto-RP Example with filter-autorp boundaries Site A (HQ) Interface Serial0 ip multicast boundary 10 filter-autorp /16 The filter-autorp option prevents Site -Local RP information from leaking out of the Site. access-list 10 deny access-list 10 permit any Border A Site-Local Boundaries S0 Interface Serial0 ip multicast boundary 10 filter-autorp Site-Local Boundaries Site B (LA) S0 Border B S1 S0 access-list 10 deny access-list 10 permit any Border C Site C (ATL) Interface Serial0 ip multicast boundary 10 filter-autorp / /16 Interface Serial1 ip multicast boundary 10 filter-autorp access-list 10 deny access-list 10 permit any 79 Administratively-Scoped Zones Auto-RP Example with filter-autorp boundaries Site A (HQ) interface Loopback0 ip address Site Local C-RP/MA ip pim send-rp-discovery scope 15 ip pim send-rp-announce Loopback0 scope 15 group 20 access-list 20 permit Site Local C-RP/MA Configuring Site -Local RP s and Mapping Agents at each site. (Only the LA site shown.) interface Loopback0 ip address Border A ip pim send-rp-discovery scope 15 ip pim send-rp-announce Loopback0 scope 15 group 20 S0 Site B (LA) S0 S1 S0 access-list 20 permit Border B Border C Site C (ATL) Site Local C-RP/MA Site Local C-RP/MA Site Local C-RP/MA Site Local C-RP/MA _04F9_c2.scr 40

41 Administratively-Scoped Zones Auto-RP Example with filter-autorp boundaries Site A (HQ) Site Local C-RP/MA Border A S0 Site Local C-RP/MA Still need Org-Local RP for all non-site Local Groups. Org-Local C-RP Org-Local C-RP Org-Local C-RP s (non-site Local Groups) Site B (LA) S0 Border B S1 S0 Border C Site C (ATL) Site Local C-RP/MA Site Local C-RP/MA Site Local C-RP/MA Site Local C-RP/MA 81 Administratively-Scoped Zones Example Australia China ASIAPAC North America India Canada East Coast US Japan Core West Coast US North Region EMEA Internet Eastern Region South Region _04F9_c2.scr 41

42 Administratively-Scoped Zones Example Level1: Site Scope RPChina India RP Australia RP ASIAPAC RP Canada North America East Coast US RP Japan RP Core West Coast US RP North RP Region EMEA Internet Site Local Range: x.x RP per Site Reusable range South Region RP Eastern Region RP 83 Administratively-Scoped Zones Example Level2: Regional Scope Australia China ASIAPAC North America India Canada East Coast US Japan RP Core West Coast US RP North Region EMEA Enterprise Regional Admin Scoped Range: Internet 239.[ ].x.x RP per Region Reusable range South Region RP Eastern Region _04F9_c2.scr 42

43 Administratively-Scoped Zones Example Level3: Enterprise Global Scope China Australia ASIAPAC North America India Canada East Coast US Japan RP Core West Coast US RP Enterprise Global Administrative Scoped Range: 239.[0-191].x.x Internet Multiple Admin Scoped RPs (via MSDP full mesh) Private Address Space within the Enterprise, no Internet connectivity for this range North Region South Region RP EMEA Eastern Region 85 Administratively-Scoped Zones Example Level 4: Internet Global Scope China Australia ASIAPAC North America India Canada East Coast US Japan RP Core West Coast US RP North Region EMEA Internet Global Sparse mode Address Space [2-255].x Multiple Global RPs (via MSDP full mesh) MSDP connectivity to provider s RPs South Region RP Eastern Region _04F9_c2.scr 43

44 Advanced Multicast Engineering Security High Availability Using Admin. Scoped Zones Scaling Multicast Performance 87 Common Campus Design Core Network Stub Network Users Stub Network Servers Stub Network Users _04F9_c2.scr 44

45 Non-RPF Performance Problem Routers normally send Prunes in response to the arrival of non-rpf traffic. On P2P links, upstream sending router prunes flow. Prunes can be overridden on Multi-access links: Result: By downstream routers on the link that need the traffic. By member hosts on the link. Certain multi-access network topologies result in non- RPF traffic that can t be pruned. Can result in high CPU loads on some routers. 89 Non-RPF Performance Problem Core Network Choke, Gasp, Pant, Wheeze!! E0 A High-rate Non-RPF Traffic B E0 High-rate MPEG Video /24 Non-RPF traffic may be dropped at Process-Switch level! Depends on the platform. Occurs on 6500 s and 8540 s. CPU load can sky-rocket! _04F9_c2.scr 45

46 6500/8540 Stub Network Solution Core Network E0 A B E /24 Interface Interface E0 E0 ip ip access-group access-group in in access-list access-list permit permit ip ip any any access-list access-list permit permit ip ip any any access-list access-list permit permit ip ip any any access-list access-list deny deny ip ip any any access-list access-list permit permit ip ip any any any any ACL used to block non-rpf traffic /8540 Stub Network Solution Allows multicast traffic to be sourced from network. Permits router to receive critical protocol (OSPF, etc.) multicast. Drops all remaining (non-rpf) multicast traffic. Permits all other traffic. Handled in ACL hardware by 6500/8540. Use only on Stub networks!!! Interface Interface E0 E0 ip ip access-group access-group in in access-list access-list permit permit ip ip any any access-list access-list permit permit ip ip any any access-list access-list permit permit ip ip any any access-list access-list deny deny ip ip any any access-list access-list permit permit ip ip any any any any ACL implemented automatically by the mls ip multicast stub command in 12.1(?)E _04F9_c2.scr 46

47 Core Network Solution Use p2p VLAN s to avoid non-rpf problem. Core Network Separate VLAN s Stub Network Users Stub Network Servers Stub Network Users 93 Multicast Router Performance Performance Impacted by: Packet Replication Loads State Maintenance Loads PIM Signaling Loads _04F9_c2.scr 47

48 Multicast Packet Replication OIL size affects performance Gasp, pant, wheeze!! Receiver Receiver Source 100 Packet Replications Receiver 100 Remote Sites w/receivers Receiver 95 Software-based Packet Replication I/O Buffer Input MAC Header Buffered I/O with 2 OIF Copy I/O Buffer Output MAC Header 2 I/O Buffer Output MAC Header 1 Multicast Packet Copy Multicast Packet Multicast Packet Unused Arriving Packet Unused Allocate New Buffer Unused Allocate New Buffer CPU load increases dramatically. Performance suffers _04F9_c2.scr 48

49 Software-based Packet Replication Particle I/O with 2 OIF Particle Buffers Input MAC Header Particle Buffer Output MAC Header 1 Particle Buffer Output MAC Header 2 Multicast Fragment 1 Allocate New Particle Allocate New Particle Multicast Packet Multicast Fragment 2 Multicast Fragment 3 Arriving Packet Reduced CPU load. Improved Performance. 97 Software-based Packet Replication Platforms that support Particle I/O 7200 Series Routers 7100 Series Routers 2600/3600/3700 Series Routers VIP2 Line Cards Local card replication only _04F9_c2.scr 49

50 Hardware-based Packet Replication Cat 4000 Uses Special Replication Hardware 7600/Cat6500 Uses Special Replication Hardware GSR Method varies by line card type ESR (10K) Uses Pipeline processor 99 Multicast State Maintenance CPU load factors Must perform RPF recalculation every 5 seconds Watch the total number of mroute table entries Unicast route table size impacts RPF recalculation Must maintain Interface and Entry Timers Large OIL sizes significantly increase load Timer processing optimized in IOS 12.?(?) Greatly improves PIM scalability _04F9_c2.scr 50

51 Multicast State Maintenance Memory load factors (*, G) entry ~ 380 bytes + OIL size (S, G) entry ~ 220 bytes + OIL size Outgoing interface list (OIL) size Each oil entry ~ 150 bytes Memory consumption is typically not a factor 101 PIM Signaling Signaling Loads Register sending/receiving During source start-up Periodic Registers every 2 minutes Periodic Joins/Prunes Sent once per second Topology changes Can trigger large numbers of Join/Prune messages Batch Join/Prune signaling added in IOS 12.?(?) Significantly improves convergence time in networks with large amounts of mroute state _04F9_c2.scr 51

52 PIM Protocol Extensions Source Specific Multicast Bidirectional (Bidir) PIM 103 Barriers to Multicast Deployment Global Multicast Address Allocation Dynamic Address Allocation No adequate dynamic address allocation methods exist SDR Doesn t scale MASC Long ways off! Static Address Allocation (GLOP) Based on AS number. Insufficient address space for large Content Providers. Multicast Content Jammers Undesirable sources on a multicast group. Capt. Midnight sources bogus data/noise to group. Can cause DoS attack by congesting low speed links _04F9_c2.scr 52

53 Source Specific Multicast (SSM) Uses Source Trees only. Assumes One-to-Many model. Most Internet multicast fits this model. IP/TV also fits this model. Hosts responsible for source discovery. Typically via some out-of-band mechanism. Web page, Content Server, etc. Eliminates need for RP and Shared Trees. Eliminates need for MSDP. 105 SSM Overview Hosts join a specific source within a group. Content identified by specific (S,G) instead of (*,G). Hosts responsible for learning (S,G) information. Last-hop router sends (S,G) join toward source Shared Tree is never Joined or used. Eliminates possibility of content Jammers. Only specified (S,G) flow is delivered to host. Simplifies address allocation. Dissimilar content sources can use same group without fear of interfering with each other _04F9_c2.scr 53

54 SSM Example Source Host learns of source, group/port First-hop learns of source, group/port First-hop send PIM (S,G) Join PIM (S, G) Join A B C D Out-of-band source directory, example: web server IGMPv3 (S, G) Join E F Receiver SSM Example Source Result: Shortest path tree rooted at the source, with no shared tree. A B C D Out-of-band source directory, example: web server E F Receiver _04F9_c2.scr 54

55 SSM Configuration Global command ip pim ssm {default <acl>} Defines SSM address range Default range = /8 Use ACL for other ranges Prevents Shared Tree Creation (*, G) Joins never sent or processed PIM Registers never sent or processed Available in IOS versions 12.1(5)T, 12.2, 12.0(15)S, 12.1(8)E 109 SSM Configuration of Legacy Routers Only Last-Hop routers must be upgraded. Core may be upgraded later. Must insure no Shared Trees in SSM range. Use ip pim accept-register at RP. Prevents sources from registering in 232/8. Use ip pim accept-rp on all routers. Prevents (*,G) Joins from being processed for 232/8. Use ip msdp sa-redistribute at RP. Stops SA message origination in 232/8. Use ip msdp sa-filter on MSDP peers. Prevents forwarding of SA messages in 232/ _04F9_c2.scr 55

56 SSM Summary Uses Source Trees only. Hosts are responsible for source & group discovery. Hosts must signal router which (S,G) to join. Solves multicast address allocation problems. Flows differentiated by both source and group. Content providers can use same group ranges. Since each (S,G) flow is unique. Helps prevent certain DoS attacks Bogus source traffic: Can t consume network bandwidth. Not received by host application. 111 PIM Protocol Extensions Source Specific Multicast Bidirectional (Bidir) PIM _04F9_c2.scr 56

57 Multicast Application Categories One-to-Many Applications Video, TV, Radio, Concerts, Stock Ticker, etc. Few-to-Few Applications Small (<10 member) Video/Audio Conferences Few-to-Many Applications TIBCO RV Servers (Publishing) Many-to-Many Applications Stock Trading Floors, Gaming Many-to-Few Applications TIBCO RV Clients (Subscriptions) 113 Multicast Application Categories PIM-SM (S, G) State One-to-Many Applications Single (S,G) entry Few-to-Few Applications Few (<10 typical) (S,G) entries Few-to-Many Applications Few (<10 typical) (S,G) entries Many-to-Many Applications Unlimited (S,G) entries Many-to-Few Applications Unlimited (S,G) entries _04F9_c2.scr 57

58 Multicast State Maintenance CPU load factors Must send/receive Registers Must send periodic Joins/Prunes Must perform RPF recalculation every 5 seconds Watch the total number of mroute table entries Unicast route table size impacts RPF recalculation Memory load factors (*, G) entry ~ 380 bytes + OIL size (S, G) entry ~ 220 bytes + OIL size Outgoing interface list (OIL) size Each oil entry ~ 150 bytes 115 Many-to-Any State Problem Creates huge amounts of (S,G) state State maintenance workloads skyrocket High OIL fanouts make the problem worse Router performance begins to suffer Using Shared-Trees only Provides some (S,G) state reduction Results in (S,G) state only along SPT to RP Frequently still too much (S,G) state Need a solution that only uses (*,G) state _04F9_c2.scr 58

59 Bidirectional (Bidir) PIM Idea: Use the same tree for traffic from sources towards RP and from RP to receivers Benefits: Less state in routers Only (*, G) state is used Source traffic follows the Shared Tree Flows up the Shared Tree to reach the RP. Flows down the Shared Tree to reach all other receivers. 117 Bidirectional (Bidir) PIM Bidirectional Shared-Trees Violates current (*,G) RPF rules Traffic often accepted on outgoing interfaces. Care must be taken to avoid multicast loops Requires a Designated Forwarder (DF) Responsible for forwarding traffic up Shared Tree DF s will accept data on the interfaces in their OIL. Then send it out all other interfaces. (Including the IIF.) _04F9_c2.scr 59

60 Bidirectional (Bidir) PIM Designated Forwarders (DF) On each link the router with the best path to the RP is elected to be the DF Note: Designated Routers (DR) are not used for bidir groups The DF is responsible for forwarding traffic upstream towards the RP No special treatment is required for local sources 119 Bidirectional PIM Example Receiver RP Sender/ Receiver Shared Tree Receiver _04F9_c2.scr 60

61 Bidirectional PIM Example Receiver RP Sender/ Receiver Source Traffic forwarded bidirectionally using (*,G) state. Shared Tree Source Traffic Receiver 121 Configuring Bidir PIM (Auto-RP Example) Define Candidate RP and groups / modes it is willing to serve ip pim send-rp-announce Loopback0 scope 10 group-list 45 bidir ip pim send-rp-announce Loopback1 scope 10 group-list 46! Two loopbacks needed due to a nature of ACLs (permit, deny) ip pim send-rp-discovery scope 10 access-list 45 permit access-list 45 permit ! 224/8 and 227/8 will be PIM Bidir groups access-list 45 deny ! 225/8 will be a PIM Dense Mode group access-list 46 permit ! 226/8 will be a PIM Sparse Mode group _04F9_c2.scr 61

62 Bidir PIM Phantom RP RP E0 (DF) E0 E0 E E1 (DF) F E1 (DF) E0 E0 E0 E0 A B C D E1 (DF) E1 (DF) E1 (DF) E1 (DF) Source Receiver 2 Receiver 1 Question: Does a Bidir RP even have to physically exist? Answer: No. It can just be a phantom address. 123 Bidir PIM Phantom RP E0 (DF) E0 E0 E E1 (DF) F E1 (DF) E0 E0 E0 E0 A B C D E1 (DF) E1 (DF) E1 (DF) E1 (DF) (*, ), 00:32:20/00:02:59, RP , flags: BP Bidir-Upstream: Ethernet0, RPF nbr Source Outgoing Receiver interface 2 list: Ethernet0, Bidir-Upstream/Sparse-Dense, 00:32:20/00:00:00 Receiver 1 Router E forwards traffic onto core LAN segment _04F9_c2.scr 62

63 Bidir PIM Phantom RP E0 (DF) E0 E0 E E1 (DF) F E1 (DF) E0 E0 E0 E0 A B C D E1 (DF) E1 (DF) E1 (DF) E1 (DF) (*, ), 00:00:49/00:02:41, RP , flags: B Bidir-Upstream: Ethernet0, RPF nbr Outgoing interface list: Source Ethernet0, Receiver Bidir-Upstream/Sparse-Dense, 2 00:00:49/00:00:00 Receiver 1 Ethernet1, Forward/Sparse-Dense, 00:00:49/00:02:41 Router F forwards traffic on down the Shared Tree ala normal PIM-SM. RP doesn t even have to physically exist. 125 Phantom RP on Point-to-Point Core Static Route Method P RP: S ip multicast-routing interface Loopback0 ip address ip pim sparse-mode router ospf 11 redistribute static subnets ip route Loopback0 ip pim bidir-enable ip pim rp-address bidir ip multicast-routing interface Loopback0 ip address ip pim sparse-mode router ospf 11 redistribute static subnets ip route Loopback0 ip pim bidir-enable ip pim rp-address bidir _04F9_c2.scr 63

64 Phantom RP on Point-to-Point Core Netmask Method P RP: S ip multicast-routing! interface Loopback0 ip address ip pim sparse-mode ip ospf network point-to-point! router ospf 11 network area 0 network area 0 network area 0! ip pim bidir-enable ip pim rp-address ip pim rp-address bidir ip multicast-routing! interface Loopback0 ip address ip pim sparse-mode ip ospf network point-to-point! router ospf 11 network area 0 network area 0 network area 0! ip pim bidir-enable ip pim rp-address ip pim rp-address bidir 127 Bidir PIM Summary Drastically reduces network mroute state Eliminates ALL (S,G) state in the network SPT s between sources to RP eliminated Source traffic flows both up and down Shared Tree Allows Many-to-Any applications to scale Permits virtually an unlimited number of sources _04F9_c2.scr 64

65 Recommended Reading Developing IP Multicast Networks, Volume I ISBN: Available on-site at the Cisco Company Store 129 Please Complete Your Evaluation Form Session RST _04F9_c2.scr 65

66 Session Number Presentation_ID _04F9_c2.scr 66