Subject: How can we block Novell 5.0 SLP multicast using only one RP?

From: [email-masked]
Date: Thu, 03 Jun 1999 22:19:51 +0200

Warning: This message is Cisco specific in parts.

I sent this originally to the [email-masked] list, but was
recommended to try the SVRLOC list instead.

We are starting to see some deployment of Novell 5.0, which uses SLP
(RFC 2165) and thus multicast addresses 224.0.1.22 and 224.0.1.35
(and port 427) for a lot of the functions previously done by IPX SAP
announcements. This seems to work rather well, but has the interesting
effect that people are suddenly starting to see servers that are very
far away topologically (outside their own organization). This is a bit
disconcerting to many since they are used to only seeing file servers,
printers etc. within their own organization.

We would like to control this, and thus need to limit the distribution
of traffic to 224.0.1.22 and 224.0.1.35. This has turned out to be more
difficult than we thought.

Our multicast infrastructure is based on PIM SM, with only one RP in
the whole AS. We thought we could use the "ip multicast boundary"
statement to limit the distribution of multicast traffic to 224.0.1.22
and 224.0.1.35. Unfortunately, this seems to work *only* on the router
with has the RP - adding this statement to other routers (for instance
between each organization and the backbone) seems to have no effect.
Also, since the multicast traffic *to* the RP is often encapsulated,
using normal access lists between each organization and the backbone
doesn't work.

Any ideas of how we could keep SLP announcements within the organization
while at the same time letting other multicast traffic be distributed
through the whole AS? (We know we can do this with multiple RPs, but we
would prefer to avoid the multiple RPs if we could.)

Steinar Haug, Nethelp consulting, [email-masked]

---

From: Erik Guttman <[email-masked]>
Date: Fri, 4 Jun 1999 15:35:07 +0200 (MET DST)

Steinar,

SLPv2 uses Administrative Scoped Multicast Addresses (see RFC 2365).
The scope of multicast requests is contained within administratively
configured boundaries using this range.  Cisco routers includes support
for administratively scoped address ranges.

SLPv1, which uses a globally scoped multicast address, does use a TTL
of 32 in order to indicate that it is 'site local.'  It may be possible
to not propogate multicast SLP messages past intermediate routers on 
the basis of their TTL value.  I am not an expert at configuring Cisco
routers, so I'm not sure.

Erik

---

From: Erik Guttman <[email-masked]>
Date: Fri, 4 Jun 1999 15:35:07 +0200 (MET DST)

Steinar,

Erik