Access Security Guide K/KA/KB.15.15

Operating rules for named source—port filters
• A port or port trunk may only have one source-port filter, named or not named.
• A named source-port filter can be applied to multiple ports or port trunks.
• Once a named source-port filter is defined, subsequent changes only modify its action, they
don’t replace it.
• To change the named source-port filter used on a port or port trunk, the current filter must first
be removed, using the no filter source-port named-filter <filter-name>
command.
• A named source-port filter can only be deleted when it is not applied to any ports.
Static multicast filters
This filter type enables the switch to forward or drop multicast traffic to a specific set of destination
ports. This helps to preserve bandwidth by reducing multicast traffic on ports where it is unnecessary,
and to isolate multicast traffic to enhance security.
You can configure up to 16 static multicast filters (defined by the filter command—page 12-20).
However, if an IGMP-controlled filter for a joined multicast group has the same multicast address
as a static multicast filter configured on a given port, the IGMP-controlled filter overrides the static
multicast filter configured on that port. Note that in the default configuration, IGMP is disabled on
VLANs configured in the switch. To enable IGMP on a specific VLAN, use the vlan < vid > ip igmp
command. (For more on this command, see “Multimedia Traffic Control with IP Multicast (IGMP)”
in the Multicast and Routing Guide for your switch.)
The total of static multicast filters and IGMP multicast filters together can range from 389 to 420,
depending on the current max-vlans setting in the switch. If multiple VLANs are configured, then
each filter is counted once per VLAN in which it is used
Table 51 Multicast filer limits
Max # multicast filters (static and IGMP combined)Max-VLANs setting
4201 (minimum)
4138 (default)
38932 or higher
Per-Port IP Multicast Filters
The static multicast filters described in this section filter traffic having a multicast address you
specify. To filter all multicast traffic on a per-VLAN basis, see “Configuring and Displaying
IGMP” in the Multicast and Routing Guide for your switch.
IP Multicast Filters
Multicast filters are configured using the Ethernet format for the multicast address. IP multicast
addresses occur in the range of 224.0.0.0 through 239.255.255.255 (which corresponds to
the Ethernet multicast address range of 01005e-000000 through 01005e-7fffff). Any static
Traffic/ Security filters configured with a multicast filter type and a multicast address in this
range will continue to be in effect unless IGMP learns of a multicast group destination in this
range. In this case, IGMP takes over the filtering function for the multicast destination address(es)
for as long as the IGMP group is active. If the IGMP group subsequently deactivates, the static
filter resumes control over traffic to the multicast address.
CAUTION: If Spanning Tree is enabled, then the MSTP multicast MAC address (0180c2- 000000)
should not be filtered. (STP will not operate properly if the MSTP multicast MAC address is filtered.)
Overview 453