4

Currently, the firewall at a small company is blocking multicast on their network. Should they continue to block multicast? Are there security concerns to unblocking it? Are there benefits to unblocking it?

1
  • 2
    What kind of firewall? Are you sure it is even setup to route multicast if it wasn't blocked?
    – Zoredache
    Jan 6, 2011 at 18:24

4 Answers 4

1

The only multicast apps I've ever used are the Ganglia monitoring tool and ntp on occasion (and that's not the default ntp configuration anyway). It's not terribly clear to me how much multicast is really used these days on small networks like you describe so I'm not sure if blocking it matters too much.

At the same time, I don't see any reason to block it inside your network without a specific threat. I vote for leaving it unblocked in your network.

I would say block it at the edge of your network just to be safe, although by default multicast isn't routed anyway unless you go through extra hoops.

1
  • 1
    Multicast is used quite heavily for mass operating system deployments and streaming broadcast video over a LAN. Of course neither of those are strong requirements for multicast in a small business LAN, but I'd hate to try and do them on a larger network without multicast.
    – Rob Moir
    Jan 7, 2011 at 9:34
8

Blocking Multicast at the border has some good things going for it. Blocking it internally I personally don't agree with. This is an opinion.

1
  • If we're talking about IPv4 and routing it is going to be disabled by default, but on individual LAN segments it is pretty moot as you have to join the group to actually receive the traffic.
    – Steve-o
    Aug 24, 2011 at 9:29
5

Here's a SANS article that might shed some light into Multicast security concerns. Also, it might be a good idea to look around SF for past Multicast questions, and notice a pattern of issues that that might potentially affect your network.

1

There's a valid argument for locking down all traffic types and only opening up what you need. I wouldn't personally extend that to blocking multicast internally on a small network but its arguably a matter of opinion (as sysadmin1138 says) rather than flat right or wrong.

If someone's blocked this as part of a policy to block everything and open up only the things they need then that seems perfectly rational to me.

If someone perceives a direct threat or issue from multicast then they may be absolutely correct (e.g. they had issues in the past and this is the fix) or they may be a little paranoid, which isn't the same as wrong.

If this block is in place however because someone doesn't know what they're doing and simply blocked everything that the CEO reckoned sounded "scary" then that's... not so good.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .