Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently, the firewall at a small company is blocking multicast on their network. Should they continue to block multicast? Are there security concerns to unblocking it? Are there benefits to unblocking it?

share|improve this question
2  
What kind of firewall? Are you sure it is even setup to route multicast if it wasn't blocked? –  Zoredache Jan 6 '11 at 18:24

4 Answers 4

up vote 1 down vote accepted

The only multicast apps I've ever used are the Ganglia monitoring tool and ntp on occasion (and that's not the default ntp configuration anyway). It's not terribly clear to me how much multicast is really used these days on small networks like you describe so I'm not sure if blocking it matters too much.

At the same time, I don't see any reason to block it inside your network without a specific threat. I vote for leaving it unblocked in your network.

I would say block it at the edge of your network just to be safe, although by default multicast isn't routed anyway unless you go through extra hoops.

share|improve this answer
1  
Multicast is used quite heavily for mass operating system deployments and streaming broadcast video over a LAN. Of course neither of those are strong requirements for multicast in a small business LAN, but I'd hate to try and do them on a larger network without multicast. –  RobM Jan 7 '11 at 9:34

Blocking Multicast at the border has some good things going for it. Blocking it internally I personally don't agree with. This is an opinion.

share|improve this answer
    
If we're talking about IPv4 and routing it is going to be disabled by default, but on individual LAN segments it is pretty moot as you have to join the group to actually receive the traffic. –  Steve-o Aug 24 '11 at 9:29

Here's a SANS article that might shed some light into Multicast security concerns. Also, it might be a good idea to look around SF for past Multicast questions, and notice a pattern of issues that that might potentially affect your network.

share|improve this answer

There's a valid argument for locking down all traffic types and only opening up what you need. I wouldn't personally extend that to blocking multicast internally on a small network but its arguably a matter of opinion (as sysadmin1138 says) rather than flat right or wrong.

If someone's blocked this as part of a policy to block everything and open up only the things they need then that seems perfectly rational to me.

If someone perceives a direct threat or issue from multicast then they may be absolutely correct (e.g. they had issues in the past and this is the fix) or they may be a little paranoid, which isn't the same as wrong.

If this block is in place however because someone doesn't know what they're doing and simply blocked everything that the CEO reckoned sounded "scary" then that's... not so good.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.