Hi, since PIM needs to be enabled on all interfaces towards senders/receivers (besides on the interfaces between the multicast routers), it'd possible for an attacker/malicious user to form a PIM neighborship with that given multicast router, to overtake the PIM DR role and to block all other receivers from accessing multicast traffic outside of their IP segment.

Loopback interfaces may be used as an RP address, if you enable PIM on them as you would your other interfaces. The advantage of a loopback interface, is that it may still be reachable, when a router has multiple interfaces, and a single physical interface fails, the loopback still may be reachable, and that makes it a more reliable choice for ...

I assume that you've got the command ip pim sparse on all the right interfaces from the outputs you gave above, but because you didn't post the interface config I can't say for certain. A good resource for configuring PIM/multicast on Nexus is the Config Guide for the platform.

In addition to establishing PIM Neighbor adjacencies, PIM Hello messages are also used to elect the Designated Router (DR) for a multi-access network. PIM routers make note (via PIM Hello messages) of the router on the network with the highest IP address. This PIM router becomes the DR for the network.

option. It makes me think that it's platform or version or interface type (or all of the above) specific. It's definitely relevant to a particular scenario. I tried it in VIRL using switches with VLAN interfaces and it was the same thing. Adding the "ip pim passive" removed the "ip pim sparse-dense-mode" command.

The “ ip pim auto-rp listener ” will cause the auto-rp group 224.0.1.39 and 224.0.1.40 to be flooded at dense. Because this command was not allowed and having configured the interfaces in Spare – Mode, I had to configure an RP for the AUTO-RP groups.

When I deleted "ip pim autorp listener" command on R1 and made it DR on the R1-R2 segment (and issued "clear ip pim rp" on all the routers), the 224.0.1.40 group traffic from R1 still continued to flow downstream, and all the routers in the chain were able to learn RP address.

ip pim rp-address 1.1.1.1 bidir Netmask on Primary RP is configured for the longest match (1.1.1.1 255.255.255.255) and secondary is configured with (1.1.1.0 255.255.255.254). The static route provides the reachability to the loopback 0.

For instance, if you affix an ACL to the "ip pim rp-address x.x.x.x" on the RP you can control for which groups the RP will become a RP. When the FHR sends the register the RP will reject it and the FHR will stop forwarding PIM register packets. You could have an ACL on the RP like so (pseudo code): access-list 1 permit <allowed group>

Important is the Note: To use PIM snooping, you must enable IGMP snooping on the switch. IGMP snooping restricts multicast traffic that exits through the LAN ports to which hosts are connected. IGMP snooping does not restrict traffic that exits through the LAN ports to which one or more multicast routers are connected.