4

Currently, the firewall at a small company is blocking multicast on their network. Should they continue to block multicast? Are there security concerns to unblocking it? Are there benefits to unblocking it?

  • 2
    What kind of firewall? Are you sure it is even setup to route multicast if it wasn't blocked? – Zoredache Jan 6 '11 at 18:24
1

The only multicast apps I've ever used are the Ganglia monitoring tool and ntp on occasion (and that's not the default ntp configuration anyway). It's not terribly clear to me how much multicast is really used these days on small networks like you describe so I'm not sure if blocking it matters too much.

At the same time, I don't see any reason to block it inside your network without a specific threat. I vote for leaving it unblocked in your network.

I would say block it at the edge of your network just to be safe, although by default multicast isn't routed anyway unless you go through extra hoops.

| improve this answer | |
  • 1
    Multicast is used quite heavily for mass operating system deployments and streaming broadcast video over a LAN. Of course neither of those are strong requirements for multicast in a small business LAN, but I'd hate to try and do them on a larger network without multicast. – Rob Moir Jan 7 '11 at 9:34
8

Blocking Multicast at the border has some good things going for it. Blocking it internally I personally don't agree with. This is an opinion.

| improve this answer | |
  • If we're talking about IPv4 and routing it is going to be disabled by default, but on individual LAN segments it is pretty moot as you have to join the group to actually receive the traffic. – Steve-o Aug 24 '11 at 9:29
5

Here's a SANS article that might shed some light into Multicast security concerns. Also, it might be a good idea to look around SF for past Multicast questions, and notice a pattern of issues that that might potentially affect your network.

| improve this answer | |
1

There's a valid argument for locking down all traffic types and only opening up what you need. I wouldn't personally extend that to blocking multicast internally on a small network but its arguably a matter of opinion (as sysadmin1138 says) rather than flat right or wrong.

If someone's blocked this as part of a policy to block everything and open up only the things they need then that seems perfectly rational to me.

If someone perceives a direct threat or issue from multicast then they may be absolutely correct (e.g. they had issues in the past and this is the fix) or they may be a little paranoid, which isn't the same as wrong.

If this block is in place however because someone doesn't know what they're doing and simply blocked everything that the CEO reckoned sounded "scary" then that's... not so good.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.