How to block all multicast traffic on port?

[eyeV]

Hi everybody!
My question is Which is most efficient way to block all ingress multicast traffic on port?

[OscarK]

The simpliest method would be creating an ACL.

Apply the following ACL on the ports or vlans.

entry BlkMcast {
if {
destination-address 224.0.0.0/4;
}
then {
deny;
count BlockedMcast;
}
}

This will block also 244.0.0.x multicasts, if you have OSPF or any other routing protocol running you might need to permit that before this block statement.

[OscarK]

No, even if the switch is L2 you can block on destination-address.

[Paul_Thornton]

If the switch is L2 only, or you need to block multicast within the VLAN then a mac address filter for the multicast bit in the MAC address would be needed (or, more simply, block any MAC address starting 01 - which has the useful side effect of not blocking broadcast traffic too).

So an acl that looked like this might be better:

entry BlockL2Mcast {
if {
ethernet-destination-address 01:00:00:00:00:00 mask ff:00:00:00:00:00;
}
then {
deny;
count BlockedMcast;
}
}

However, as others have said, this will break OSPF, VRRP, HSRP and a lot of IPv6. You'd be better off not doing this unless there's a very good reason.

Paul.

[eyeV]

Thank you!