igmp-snooping query-ip-policy (VSI E-Tree view)

Function

The igmp-snooping query-ip-policy command configures a filtering policy for IGMP Query messages.

The undo igmp-snooping query-ip-policy command restores the default configuration.

By default, no filtering policy is configured for IGMP Query messages. That is, any user hosts can use multicast services.

Format

igmp-snooping query-ip-policy { acl-number | acl-name acl-name }

undo igmp-snooping query-ip-policy

Parameters

Parameter	Description	Value
acl-number	Specifies the basic or advanced ACL.	The number of a basic ACL is an integer that ranges from 2000 to 2999. The number of an advanced ACL ranges from 3000 to 3999.
acl-name acl-name	Specifies the name of a named basic ACL.	The value is a string of 1 to 64 case-sensitive characters without spaces. The value must start with a letter (a to z or A to Z, case sensitive).

Parameter

Description

Value

acl-number

Specifies the basic or advanced ACL.

The number of a basic ACL is an integer that ranges from 2000 to 2999. The number of an advanced ACL ranges from 3000 to 3999.

acl-name acl-name

Specifies the name of a named basic ACL.

The value is a string of 1 to 64 case-sensitive characters without spaces. The value must start with a letter (a to z or A to Z, case sensitive).

Views

VSI-AUTO view, VSI-BD view, VSI-DEFAULT view, VSI-STATIC view

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
l2mc	write

Usage Guidelines

Usage Scenario

To enable a device to filter IGMP Query messages from user hosts, run the igmp-snooping query-ip-policy command to improve multicast service security.

Example

# Enable the device to deny the IGMP Query messages with the source IP address 10.0.0.1 on VSI v1 and to allow other IGMP Query messages.

<HUAWEI> system-view
[~HUAWEI] acl 2000
[*HUAWEI-acl-basic-2000] rule deny source 10.0.0.1 0
[*HUAWEI-acl-basic-2000] rule permit source any
[*HUAWEI-acl-basic-2000] quit
[*HUAWEI] igmp-snooping enable
[*HUAWEI] mpls
[*HUAWEI-mpls] quit
[*HUAWEI] mpls l2vpn
[*HUAWEI-l2vpn] quit
[*HUAWEI] vsi v1
[*HUAWEI-vsi-v1] pwsignal ldp
[*HUAWEI-vsi-v1-ldp] vsi-id 200
[*HUAWEI-vsi-v1-ldp] quit
[*HUAWEI-vsi-v1] igmp-snooping query-ip-policy 2000

# Enable the device to deny the IGMP Query messages with the source IP address 10.0.0.1 on VLAN 11 and to allow other IGMP Query messages.

<HUAWEI> system-view
[~HUAWEI] acl 2000
[*HUAWEI-acl-basic-2000] rule deny source 10.0.0.1 0
[*HUAWEI-acl-basic-2000] rule permit source any
[*HUAWEI-acl-basic-2000] quit
[*HUAWEI] igmp-snooping enable
[*HUAWEI] vlan 11
[*HUAWEI-vlan11] igmp-snooping query-ip-policy 2000