3.3.d Describe multicast protocols, such as RPF check, PIM SM, IGMP v2/v3, SSM, bidir, and MSDP

What this objective tests

The objective says "describe". The exam wants you to explain how multicast forwarding works and why it fails.

Multicast is one-to-many traffic. The source sends one copy to a group address. The network replicates packets only where receivers exist. Multicast forwarding is built around trees, receiver interest, and reverse-path checks.

Multicast roles

Note: For labs, use 239.0.0.0/8 groups. The 224.0.0.0/24 block is reserved for local control protocols. Use 232.0.0.0/8 for SSM practice.

The RPF check

Reverse Path Forwarding (RPF) is the loop-prevention check. When a router receives a multicast packet from source S, it asks one question: would I use this incoming interface to send traffic back to S?

Source 10.1.1.10
    |
   [R1]
  Gi0/0\Gi0/1
     \  /
     [R2]
R2 best route to 10.1.1.10 is via Gi0/0

• A packet from the source arrives on R2 Gi0/0. The RPF check passes. R2 forwards it.
• The same packet arrives on R2 Gi0/1. The RPF check fails. R2 drops it.

RPF checks the path back to the source, not the path toward receivers. If RPF fails, fix unicast routing first.

Verify:

show ip rpf 10.1.1.10
show ip route 10.1.1.10

IGMPv2 vs IGMPv3

Internet Group Management Protocol (IGMP) runs between hosts and the last-hop router. Hosts use it to join and leave groups.

Verify on the last-hop router:

show ip igmp groups
show ip igmp interface

PIM Sparse Mode with an RP

Protocol Independent Multicast (PIM) builds the router-to-router tree. It uses the unicast routing table for RPF decisions. It does not find routes by itself.

Sparse Mode assumes receivers are rare. Receivers join toward the RP. Sources register with the RP. The shared tree is called (*,G). Later, last-hop routers can switch to a source tree (S,G).

Every router in the domain must agree on the RP.

Example: PIM Sparse Mode on two routers

Topology:

Source 10.1.1.10 -- Gi0/1 [R1] Gi0/0 10.0.12.1/30
                              |
                    Gi0/0 10.0.12.2/30 [R2] Gi0/1 -- Receiver LAN 10.2.2.0/24
R1 Lo0 10.255.255.1/32 is the RP. Group 239.1.1.1.

R1 (first-hop router and RP):

ip multicast-routing
!
interface Loopback0
 ip address 10.255.255.1 255.255.255.255
 ip pim sparse-mode
!
interface GigabitEthernet0/0
 description To R2
 ip address 10.0.12.1 255.255.255.252
 ip pim sparse-mode
!
interface GigabitEthernet0/1
 description Source LAN
 ip address 10.1.1.1 255.255.255.0
 ip pim sparse-mode
!
router ospf 10
 network 10.0.0.0 0.255.255.255 area 0

R2 (last-hop router):

ip multicast-routing
!
ip pim rp-address 10.255.255.1
!
interface GigabitEthernet0/0
 description To R1
 ip address 10.0.12.2 255.255.255.252
 ip pim sparse-mode
!
interface GigabitEthernet0/1
 description Receiver LAN
 ip address 10.2.2.1 255.255.255.0
 ip pim sparse-mode
 ip igmp join-group 239.1.1.1
!
router ospf 10
 network 10.0.0.0 0.255.255.255 area 0

R1 also needs ip pim rp-address 10.255.255.1 when it is not the only RP candidate. Add it for consistency. The ip igmp join-group command makes R2 act as a receiver for the lab.

Expected show ip mroute output

After the source sends traffic to 239.1.1.1:

R2# show ip mroute 239.1.1.1
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,
       L - Local, P - Pruned, R - RP-bit set, F - Register flag,
       T - SPT-bit set, J - Join SPT

(*, 239.1.1.1), 00:14:02/00:02:44, RP 10.255.255.1, flags: SJC
  Incoming interface: GigabitEthernet0/0, RPF nbr 10.0.12.1
  Outgoing interface list:
    GigabitEthernet0/1, Forward/Sparse, 00:14:02/00:02:44

(10.1.1.10, 239.1.1.1), 00:05:11/00:02:48, flags: T
  Incoming interface: GigabitEthernet0/0, RPF nbr 10.0.12.1
  Outgoing interface list:
    GigabitEthernet0/1, Forward/Sparse, 00:05:11/00:03:18

Read this output:

• The (*,G) entry is the shared tree toward the RP. Flag S means sparse mode.
• The (S,G) entry is the source tree. Flag T means the router switched to the shortest path tree.
• The incoming interface must match the RPF path to the source. The RPF nbr is the next hop back.

SSM, bidirectional PIM, and MSDP

• Source Specific Multicast (SSM): the receiver joins a specific (S,G). The typical range is 232.0.0.0/8. SSM needs no RP because the receiver names the source. Enable with ip pim ssm default. Hosts need IGMPv3.
• Bidirectional PIM: many-to-many groups share one bidirectional tree rooted at the RP. It reduces state when many sources send to the same groups.
• Multicast Source Discovery Protocol (MSDP): RPs in different PIM domains tell each other about active sources with Source Active messages. Verify with show ip msdp peer and show ip msdp sa-cache.

Exam traps

• PIM depends on the unicast routing table. Fix unicast first.
• RPF checks the path back to the source, not toward the receivers.
• IGMP is host-to-router. PIM is router-to-router.
• PIM Sparse Mode needs an RP. SSM does not.
• All routers must agree on the RP address.
• A missing (S,G) with a present (*,G) often means the source never registered or RPF fails.

Pass check

You are ready when you can do these things:

• Explain the RPF check with a small topology in one minute.
• Configure PIM Sparse Mode with a static RP on two routers.
• Read show ip mroute and name the (*,G) and (S,G) entries.
• State the difference between IGMPv2 and IGMPv3 and why SSM needs v3.
• Describe in one sentence what MSDP does between RPs.