# Multicast MSDP SA (Source Active) Filtering
**URL:** https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784
**Category:** Lessons Discussion
**Created:** [January 23, 2018, 6:05pm UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784 "2018-01-23T18:05:37Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [January 23, 2018, 6:05pm UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/1 "2018-01-23T18:05:37Z")
This topic is to discuss the following lesson:
[https://networklessons.com/cisco/ccie-enterprise-infrastructuremulticast-msdp-sa-source-active-filtering/](https://networklessons.com/cisco/ccie-enterprise-infrastructuremulticast-msdp-sa-source-active-filtering/)
---
### Author:  [@samer.rafid](https://forum.networklessons.com/u/samer.rafid)
#### Post date: [August 1, 2018, 8:18am UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/2 "2018-08-01T08:18:15Z")
Hi Rene,
I think this topics should be also put in CCIE R/S since its on CCIE blue printer, not only under written…just a suggestion
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [August 3, 2018, 3:03pm UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/3 "2018-08-03T15:03:08Z")
Hello Samer
Thanks for the suggestion! @ReneMolenaar will take a look and when he gets a chance.
Thanks again!
Laz
---
### Author:  [@hengsovandara1345](https://forum.networklessons.com/u/hengsovandara1345)
#### Post date: [December 21, 2018, 10:13am UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/4 "2018-12-21T10:13:04Z")
Hi Rene
I really confuse about this, since R1 connected to R2 via internet, so MSDP can establish peering through global network which not enable multicast routing like internet ? and can we send multicast traffic from one site to one site through internet without using VPN ?
Sovandara
Thank you
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [January 2, 2019, 1:03pm UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/5 "2019-01-02T13:03:55Z")
Hello Heng
The important thing to note here is that multicast mechanisms are not being employed over the Internet itself. MSDP allows for two edge routers to share multicast information such that multicast traffic can be sent between them. Such multicast traffic is sent using PIM Sparse Mode, which means that multicast traffic traversing the internet is sent to the RP that is at the edge of the other autonomous system and is being used as the specific “next hop” of the multicast traffic. Remember, the RP knows about all the sources and receivers for any particular multicast group.
Note that no intervening routers on the Internet are employing multicast mechanisms.
More about MSDP can be found here:
> **[IP Multicast Technology Overview](https://www.cisco.com/c/en/us/td/docs/ios/solutions_docs/ip_multicast/White_papers/mcst_ovr.html#wp1015335)**
>
> IP Multicast Technology Overview
I hope this has been helpful!
Laz
---
### Author:  [@souam.zouhair](https://forum.networklessons.com/u/souam.zouhair)
#### Post date: [February 18, 2021, 12:28pm UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/6 "2021-02-18T12:28:06Z")
Hello René,
Great work, thank you.
I had a problem with your ACL that match also the source address deny ip 192.168.0.0 0.0.255.255 any, with this entry the filter will not work because the source is using 192.168.0.0/24 segment. could you confirm that please ?
regards,
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [March 1, 2021, 5:37am UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/7 "2021-03-01T05:37:43Z")
Hello Zouhair
You don’t necessarily have to choose to filter all private addresses, you can filter only some, whichever ones you choose. Typically MSDP is used on a network where you have multiple LANs connected to each other through private WANs. It is over that private WAN that you would want to filter out some addresses, possibly the ones that you wouldn’t want to send over the WAN for purposes of saving bandwidth.
So although the example uses the private address space, it would not necessarily be so in a production network.
I hope this has been helpful!
Laz
---
### Author:  [@sven.heine](https://forum.networklessons.com/u/sven.heine)
#### Post date: [July 4, 2024, 8:33am UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/8 "2024-07-04T08:33:45Z")
I consider this an unimportant remark, but _possibly_ still slightly mentionworthy:
From [https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml](https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml)
“The range of addresses between 224.0.0.0 and 224.0.0.255, inclusive, is reserved for the use of routing protocols and other low-level topology discovery or maintenance protocols, such as gateway discovery and group membership reporting. Multicast routers should not forward any multicast datagram with destination addresses in this range, regardless of its TTL.”
Currently, I don’t know how to conjure up examples as to why this should not be filtered. If so, I’d like it to see examples mentioned.
Thank you for your article @René’s crew (including René, naturally).
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [July 8, 2024, 4:19am UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/9 "2024-07-08T04:19:31Z")
Hello Sven
This range of multicast addresses 224.0.0.0/24 is called the local network control block. As suggested in the text you shared, it is non-routable and used for routing protocols and other control plane protocols. Indeed, OSPF uses the 224.0.0.5 and 224.0.0.6 addresses for its operation, and RIP uses 224.0.0.9, all of which are within this multicast range.
The statement “Multicast routers should not forward any multicast datagram with destination addresses in this range” simply means that routing devices must not and will not route this traffic. So traffic destined to any address within 224.0.0.0/24 will, by definition, remain within the subnet/network segment within which it originated, and will never be routed outside of that segment.
This is simply a declaration of how such traffic behaves, and that all routing devices must conform to this. You don’t actually have to filter such traffic, it is automatically done. Does that make sense?
You can find out more (including links) at the following [NetworkLessons Notes page on the topic](https://notes.networklessons.com/multicast-local-network-control-block).
I hope this has been helpful!
Laz
---
### Author:  [@sven.heine](https://forum.networklessons.com/u/sven.heine)
#### Post date: [July 8, 2024, 4:49am UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/10 "2024-07-08T04:49:46Z")
Hallo Laz,
na klar macht das Sinn. / Of course, that makes sense.
I just didn’t know that routers have this implicit behaviour coded in (similar to private network ranges). (Or: I got stuck on “should” in the IANA’s declaration.)
What does that mean for me?: “Ask yourself for possible implicit behaviour.”
(You have satisfied my curiosity.)
Dank u wel (also, for the reference onto this part of your pages).
---
### Author:  [@davidilles](https://forum.networklessons.com/u/davidilles)
#### Post date: [May 30, 2026, 10:16am UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/11 "2026-05-30T10:16:07Z")
Hello, everyone.
When we are running MSDP, what IP address should our sources use? Rene says that we might want to filter those that use private IPs, so should multicast sources be assigned public IPs, then?
![obrázok]()
Also, what multicast groups should we use for Inter-AS? Rene again states that multicast groups in the administrative 239.0.0.0/8 range could be filtered.
Thank you
David
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [June 1, 2026, 5:03am UTC](https://forum.networklessons.com/t/multicast-msdp-sa-source-active-filtering/2784/12 "2026-06-01T05:03:57Z")
Hello David
What Rene is advocating here is not a general rule that states “filter private addresses.” Rather, MSDP is often used to exchange source-active information between multicast domains, sometimes across AS or administrative boundaries. In those cases, you normally do not want to advertise internal-only multicast state to remote MSDP peers.
For inter-domain multicast to work, the multicast source address must be reachable through unicast routing from the remote multicast domain. So if this is a public inter-AS design, the source would normally need to use a globally routable unicast IP address. If the source uses an RFC1918/private address, the remote domain will usually not be able to build a valid path back toward that source, unless this is a private/controlled environment where both sides intentionally route those private addresses.
So filtering SA messages for private source addresses is mainly a policy and reachability issue. It prevents leaking internal infrastructure information and avoids advertising sources that remote domains cannot realistically reach.
> [@davidilles](#):
>
> Also, what multicast groups should we use for Inter-AS? Rene again states that multicast groups in the administrative 239.0.0.0/8 range could be filtered.
You would normally use globally scoped multicast group addresses, except for the link local range (224.0.0.0/24), which is not routable, and the administratively scoped range (239.0.0.0/8). These are the ranges that should not cross administrative boundaries and should thus be filtered between MSDP peers.
I hope this has been helpful!
Laz