| 8.4 |  | Routing and Multicast Configuration |
| 8.4.4 |  | Allowing hosts to receive multicast transmissions |

| When hosts that need to receive a multicast transmission are separated from the multicast router by a PIX Security Appliance, configure the PIX Security Appliance to forward IGMP reports from the downstream hosts and to forward multicast transmissions from the upstream router. To allow hosts to receive multicast transmissions through the PIX Security Appliance, complete the following steps :

1. Use the multicast interface command to enable multicast forwarding on each interface, and place the interfaces in multicast promiscuous mode. Upon entering this command, the CLI enters multicast subcommand mode, and the prompt changes to (config-multicast)#. From this prompt, the user can enter the igmp commands for further multicast support. The clear multicast command clears all multicast settings. The syntax for the multicast interface command is as follows :

   > multicast interface interface_name [max-groups number]

2. Use the igmp forward command to enable IGMP forwarding on each PIX Security Appliance interface connected to hosts that will receive multicast transmissions. This is typically an inside or more secure interface. The igmp forward command enables forwarding of all IGMP host report and leave messages received on the interface specified.
3. Use the igmp join-group command to configure the PIX Firewall to join a multicast group. This step is optional. The igmp join-group command configures the interface to be a statically connected member of the specified group. It allows the PIX Security Appliance to act for a client that may not be able to respond via IGMP, but still requires reception. The igmp join-group command is applied to the downstream interface towards the receiving hosts.

   A multicast group is defined by a Class D IP address. Although Internet IP Multicasting uses the entire range of 224.0.0.0 to 239.255.255.255, any group address assigned must be within the range of 224.0.0.2 to 239.255.255.255.

   Because the address 224.0.0.0 is the Base Address for Internet IP Multicasting, it cannot be assigned to any group. The address 224.0.0.1 is assigned to the permanent group of all IP hosts, including gateways. This is used to address all multicast hosts on the directly connected network. There is no multicast address, or any other IP address, for all hosts on the total Internet.

4. Use the permit option of the access-list command to configure an ACL that allows traffic to the desired Class D destination addresses. The deny option can be used to deny access to transmissions from specific multicast groups. Both of these commands are optional.

   Within the ACL, the destination-address argument is the Class D address of the multicast group to which multicast transmissions are to be permitted or denied. If ACLs are used for this purpose, the igmp access-group command must also be used to apply the ACL to the currently selected interface.

   The syntaxes for the igmp sub-commands are as follows:

   > igmp forward interface interface_name

   > igmp join-group group

   > igmp access-group acl-id

Figure shows use of the multicast command with corresponding igmp subcommands. IGMP query messages are permitted on the outside interface. The igmp forward command enables the PIX Security Appliance to forward IGMP reports from inside hosts to the multicast router on its outside interface.

In the example in Figure , host 10.0.0.11 joins multicast group 224.1.1.1. The PIX Security Appliance then permits host 10.0.0.11 to receive multicasts from the multicast host on the 172.16.0.0 network.