Jon,

Thanks for your response!

I understand IGMP snooping is enabled by default.

6509-c4-01#sh run | i igmp

6509-c4-01#

6509-c4-01#sh ip igmp snooping mrouter

vlan ports

-----+----------------------------------------

601 Fa3/2,Fa3/3

6509-c4-01#

3/2 connects to RP

3/3 connect to firewall1

3/4 connects to backup firewall2

So per the URL you mentioned, PIM snooping should block the multicast traffic on port 3/4

John

Apologies meant to give you a link to IGMP.

Anyway PIM snooping will not block traffic to a port with a firewall on it. You need IGMP snooping for that.

However if you haven't enabled PIM on the vlan 601 interface and from your config it looks like it isn't you need to either

1) enable PIM routing on vlan 601 interface

2) Enable the "igmp snooping querier" function on the 6500.

I would go with 2.

Edit - apologies having a bad day with links today :-)

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/snooigmp.html#wp1050624

Jon

Jon,

PIM snoop was already enabled under VLAN601 (config is there in my initial email).

I think in this scenario the firewalls are equivalent to routers as the Netscreen firewalls are configured for IGMP and PIM.

The reciever(PC) is connected to the firewall.

when the IGMP join is sent by the reciever to the firewall it will send the PIM join to the RP.

so when PIM snooping is enabled on the 6509 switch, it will "see" the PIM join from port 3/3 and detect the RP on port 3/2.

see below:

6509-c4-01#sh ip pim snoop

Global runtime mode: Enabled

Global admin mode : Enabled

SGR-Prune Suppression: Enabled

Number of user enabled VLANs: 1

User enabled VLANs: 601

6509-c4-01#sh ip pim snoop mr

Flags: J/P - (*,G) Join/Prune, j/p - (S,G) Join/Prune

SGR-P - (S,G,R) Prune

VLAN 601: 2 mroutes

(*, 239.0.0.5), 19:16:50/00:02:45

132.1.1.1->132.1.1.20, 19:16:50/00:02:45, J

Downstream ports: 3/3

Upstream ports: 3/2

Outgoing ports: 3/2 3/3

(132.1.1.20, 239.0.0.5), 19:16:50/00:02:45

132.1.1.1->132.1.1.20, 19:16:50/00:02:45, j

Downstream ports: 3/3

Upstream ports: 3/2

Outgoing ports: 3/2 3/3

But the switch is flooding the multicast on all the ports in the VLAN i.e. 3/4 as well.

I tried option 2 (IGMP querier) but even that didn't help.

any clues what I am doing is wrong?

Thanks!

John

John

Can you post output of

"show ip igmp snooping mrouter vlan 601"

"sh ip igmp memebership"

"sh ip igmp interface"

Can you also confirm that Netscreens are using Pim v2 please.

Jon