IGMP Filter

[lagapidis (Lazarus Agapidis)]

Hello Agostinho

@agostinhofilipemaia

On a standard ACL, you block the source IP address but here you want to block the destination IP.

Yes, a standard access list will indeed match the source IP address. However, this is the case only when you apply the ACL on an interface. In this particular case, you are using the ip igmp access-group command to reference the ACL to match a particular multicast IP address. In this case, the multicast group will be matched. As stated in this Cisco command reference for the ip igmp access-group command:

Use the ip igmp access-group command to filter groups from Internet Group Management Protocol (IGMP) reports by use of a standard access list … This command is used to restrict hosts on a subnet to joining only multicast groups that are permitted by a standard IP access list…

So in this scenario there is really no concept of source or destination address. It simply restricts a host from joining the multicast group indicated in the ACL.

@agostinhofilipemaia

2. I’ve tried to do the same but using an extended ACL and, as expected, it also worked (but I needed to define the mcast IP as destination IP)

As stated in the same command reference indicated above, when using an extended ACL the command is used to:

…restrict hosts (receivers) on a subnet to membership to only the (S,G) channels that are permitted by an extended IP access list.

Note that only IGMPv3 accommodates the extended access lists which allow you to leverage source-specific multicast (SSM). In the extended access list, you can indicate the source of the multicast traffic as an additional parameter. Does that make sense?

I hope this has been helpful!

Laz