Example: Configuring MLD Snooping on SRX Series Devices
You can enable MLD snooping on a VLAN to constrain the flooding of IPv6 multicast traffic on a VLAN. When MLD snooping is enabled, SRX Series Firewall examines MLD messages between hosts and multicast routers and learns which hosts are interested in receiving multicast traffic for a multicast group. Based on what it learns, the device then forwards IPv6 multicast traffic only to those interfaces connected to interested receivers instead of flooding the traffic to all interfaces.
This example describes how to configure MLD snooping:
Requirements
This example uses the following software and hardware components:
One SRX Series Firewall
Junos OS Release 18.1R1
Before you configure MLD snooping, be sure you have:
Configured the
vlan100VLAN on the deviceAssigned interfaces
ge-0/0/0,ge-0/0/1,ge-0/0/2, andge-0/0/3tovlan100Configured
ge-0/0/3as a trunk interface.
Overview and Topology
In this example, interfaces ge-0/0/0, ge-0/0/1, and ge-0/0/2 on the device are in vlan100 and are connected to hosts that are potential multicast receivers.
Interface ge-0/0/3, a trunk interface also in vlan100, is connected to a multicast router. The router acts as the MLD
querier and forwards multicast traffic for group 2001:db8::1 to the device from a multicast source.
Topology
The example topology is illustrated in Figure 1.
In this example topology, the multicast router forwards multicast
traffic to the device from the source when it receives a memberhsip
report for group 2001:db8::1 from one of the hosts—for
example, Host B. If MLD snooping is not enabled on vlan100, then the device floods the multicast traffic on all interfaces
in vlan100 (except for interface ge-0/0/3).
If MLD snooping is enabled on vlan100, the device monitors
the MLD messages between the hosts and router, allowing it to determine
that only Host B is interested in receiving the multicast traffic.
The device then forwards the multicast traffic only to interface ge-0/0/1.
This example shows how to enable MLD snooping on vlan100. It also shows how to perform the following optional configurations,
which can reduce group join and leave latency:
Configure immediate leave on the VLAN. When immediate leave is configured, the device stops forwarding multicast traffic on an interface when it detects that the last member of the multicast group has left the group. If immediate leave is not configured, the device waits until the group-specific membership queries time out before it stops forwarding traffic
Configure
ge-0/0/3as a static multicast-router interface. In this topology,ge-0/0/3always leads to the multicast router. By statically configuringge-0/0/3as a multicast-router interface, you avoid any delay imposed by the device having to learn thatge-0/0/3is a multicast-router interface.
Configuration
To configure MLD snooping on a device:
Procedure
CLI Quick Configuration
To quickly configure this example, copy the
following commands, paste them into a text file, remove any line breaks,
change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit] hierarchy
level, and then enter commit from configuration mode.
set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members vlan100 set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members vlan100 set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members vlan100 set interfaces ge-0/0/3 unit 0 family ethernet-switching interface-mode trunk set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members vlan100 set vlans vlan100 vlan-id 100 set routing-options nonstop-routing set protocols mld-snooping vlan vlan100 query-interval 200 set protocols mld-snooping vlan vlan100 query-response-interval 0.4 set protocols mld-snooping vlan vlan100 query-last-member-interval 0.1 set protocols mld-snooping vlan vlan100 robust-count 4 set protocols mld-snooping vlan vlan100 immediate-leave set protocols mld-snooping vlan vlan100 interface ge-0/0/1.0 host-only-interface set protocols mld-snooping vlan vlan100 interface ge-0/0/0.0 group-limit 50 set protocols mld-snooping vlan vlan100 interface ge-0/0/2.0 static group 2001:db8::1 set protocols mld-snooping vlan vlan100 interface ge-0/0/3.0 multicast-router-interface
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.
To configure MLD snooping:
Configure the access mode interfaces.
[edit interfaces] user@host# set ge-0/0/0 unit 0 family ethernet-switching interface-mode access user@host# set ge-0/0/0 unit 0 family ethernet-switching vlan members vlan100 user@host# set ge-0/0/1 unit 0 family ethernet-switching interface-mode access user@host# set ge-0/0/1 unit 0 family ethernet-switching vlan members vlan100 user@host# set ge-0/0/2 unit 0 family ethernet-switching interface-mode access user@host# set ge-0/0/2 unit 0 family ethernet-switching vlan members vlan100
Configure the trunk mode interface.
[edit interfaces] user@host# set ge-0/0/3 unit 0 family ethernet-switching interface-mode trunk user@host# set ge-0/0/3 unit 0 family ethernet-switching vlan members vlan100
Configure the VLAN.
[edit vlans vlan100] user@host# set vlans v100 vlan-id 100
Configure nonstop routing
[edit] user@host# set routing-options nonstop-routing
Configure the limit for the number of multicast groups allowed on the ge-0/0/1.0 interface to 50.
[edit vlans vlan100] user@host# set protocols mld-snooping vlan vlan100 interface ge-0/0/0.0 group-limit 50
Configure the device to immediately remove a group membership from an interface when it receives a leave message from that interface without waiting for any other MLD messages to be exchanged.
[edit vlans vlan100] user@host# set protocols mld-snooping vlan vlan100 immediate-leave
Statically configure interface ge-0/0/2.0 as a multicast-router interface.
[edit vlans vlan100] user@host# set protocols mld-snooping vlan vlan100 interface ge-0/0/2.0 static group 2001:db8::1
Configure an interface to be an exclusively router-facing interface (to receive multicast traffic).
[edit vlans vlan100] user@host# set protocols mld-snooping vlan vlan100 interface ge-0/0/3.0 multicast-router-interface
Configure an interface to be an exclusively host-facing interface (to drop MLD query messages).
[edit vlans vlan100] user@host# set protocols mld-snooping vlan vlan100 interface ge-0/0/1.0 host-only-interface
Configure the IGMP message intervals and robustness count.
[edit vlans vlan100] uer@host# set protocols mld-snooping vlan v100 query-interval 200 uer@host# set protocols mld-snooping vlan v100 query-response-interval 0.4 uer@host# set protocols mld-snooping vlan v100 query-last-member-interval 0.1 uer@host# set protocols mld-snooping vlan v1 robust-count 4
If you are done configuring the device, commit the configuration.
user@host# commit
Results
From configuration mode, confirm your configuration
by entering the show protocols mld-snooping command. If
the output does not display the intended configuration, repeat the
configuration instructions in this example to correct it.
[edit]
user@host# show protocols mld-snooping
vlan vlan100 {
query-interval 200;
query-response-interval 0.4;
query-last-member-interval 0.1;
robust-count 4;
immediate-leave;
interface ge-0/0/1.0 {
host-only-interface;
}
interface ge-0/0/0.0 {
group-limit 50;
}
interface ge-0/0/2.0 {
static {
group 2001:db8::1;
}
}
interface ge-0/0/3.0 {
multicast-router-interface;
}
}
Verifying MLD Snooping Configuration
To verify that MLD snooping is enabled on the VLAN and the MLD snooping forwarding interfaces are correct, perform the following task:
Verifying MLD Snooping Interface Membership on VLAN vlan100
Purpose
Verify that MLD snooping is enabled on vlan100 and that the multicast-router interface is statically configured:
Action
From operational mode, enter the show mld snooping
membership command.
user@host> show mld snooping membership
Instance: default-switch
Vlan: vlan100
Learning-Domain: default
Interface: ge-0/0/0.0, Groups: 0
Interface: ge-0/0/1.0, Groups: 0
Interface: ge-0/0/2.0, Groups: 1
Group: 2001:db8::1
Group mode: Exclude
Source: ::
Last reported by: Local
Group timeout: 0 Type: Static
Meaning
MLD snooping is running on vlan100, and
interface ge-0/0/3.0 is a statically configured multicast-router
interface. Because the multicast group 2001:db8::1 is listed,
at least one host in the VLAN is a current member of the multicast
group and that host is on interface ge-0/0/1.0.