Distribution of multicast information in a routing system

1. A routing system for providing multicast access control, the routing system comprising:

a plurality of routers comprising:

a multicast source router; and

a plurality of multicast receiver routers,

wherein the plurality of routers are configured to provide a multicast service,

wherein the plurality of routers are configured to enforce multicast access control policies for the multicast service, and

wherein the multicast access control policies comprise:

a tenant-based receiver access policy that specifies at least one receiver tenant allowed to receive packets from the multicast service, wherein the plurality of routers are further configured to accept multicast join requests for joining a multicast group for the multicast service only from interfaces of the plurality of multicast receiver routers that are associated with the at least one receiver tenant specified by the tenant-based receiver policy; and

a sender access policy that specifies the multicast source router as allowed to send packets to the multicast service for distribution to the specified at least one receiver tenant.

2. The system of claim 1 ,

wherein the sender access policy comprises a tenant-based sender access policy that specifies at least one source tenant allowed to send packets to the multicast service,

wherein the plurality of routers are further configured to accept packets sent to the multicast service only from interfaces of the multicast source router that are associated with the at least one source tenant specified by the tenant-based sender policy.

3. The system of claim 1 ,

wherein the plurality of routers are configured to receive a configuration overriding the tenant-based receiver access policy, and

wherein, in response to receiving the configuration overriding the tenant-based receiver access policy, the plurality of routers are configured to accept a multicast join request for joining the multicast group for the multicast service from an interface of the plurality of multicast receiver routers that is not associated with the at least one receiver tenant specified by the tenant-based receiver policy.

4. The system of claim 1 ,

wherein the plurality of routers are configured to receive a configuration overriding the tenant-based receiver access policy, and

wherein, in response to receiving the configuration overriding the tenant-based receiver access policy, the plurality of routers are configured to reject a multicast group join request for joining the multicast group for the multicast service from an interface of the plurality of multicast receiver routers that is associated with the at least one receiver tenant specified by the tenant-based receiver policy.

5. The system of claim 1 , wherein the plurality of routers are configured to transmit membership query messages on interfaces associated with the at least one receiver tenant specified by the tenant-based receiver policy.

6. The system of claim 1 , wherein the plurality of routers are configured to drop membership report messages received from an interface of the plurality of multicast receiver routers that is not associated with the at least one receiver tenant specified by the tenant-based receiver access policy.

7. The system of claim 1 , wherein the multicast source router is configured to replicate the packets for the multicast service by transmitting the packets as unicast packets for the multicast service to each multicast receiver router associated with the at least one receiver tenant specified by the tenant-based receiver access policy.

8. The system of claim 1 , wherein the multicast source router is configured to:

join a multicast tree for the multicast service; and

transmit a multicast packet as a unicast packet to each multicast receiver router of the plurality of multicast receiver routers.

9. The system of claim 1 , wherein each of the at least one receiver tenant and the source tenant comprise a first sub-network and a second sub-network of a plurality of sub-networks, wherein each sub-network of the plurality of sub-networks is segregated and separated from each other sub-network of the plurality of sub-networks.

10. The system of claim 1 , wherein each of the at least one receiver tenant and the source tenant comprise a Virtual Local Area Network (VLAN) instance, a Virtual eXtensible LAN (VXLAN) instance, or a Virtual Routing and Forwarding (VRF) instance.

11. A router for providing multicast access control, the router comprising:

a datastore configured to store multicast access control policies for a multicast service comprising:

a tenant-based receiver access policy that specifies at least one receiver tenant allowed to receive packets from the multicast service; and

a sender access policy that controls specifies a multicast source router as allowed to send packets to the multicast service for distribution to the specified at least one receiver tenant; and

a controller configured to enforce the multicast access control policies for the multicast service by:

accepting multicast join requests for joining a multicast group for the multicast service only from interfaces of a plurality of multicast receiver routers that are associated with the at least one receiver tenant specified by the tenant-based receiver policy; and

accepting only packets to the multicast service that are sent by the specified multicast source router.

12. The router of claim 11 ,

wherein the sender access policy comprises a tenant-based sender access policy that specifies at least one source tenant allowed to send packets to the multicast service, and

wherein the controller is further configured to accept packets sent to the multicast service only from interfaces of the multicast source router that are associated with the at least one source tenant specified by the tenant-based sender policy.

13. The router of claim 11 , wherein the controller is configured to:

receive a configuration overriding the tenant-based receiver access policy; and

in response to receiving the configuration overriding the tenant-based receiver, accept a multicast join request for joining the multicast group for the multicast service from an interface of the plurality of multicast receiver routers that is not associated with the at least one receiver tenant specified by the tenant-based receiver policy.

14. The router of claim 11 , wherein the controller is configured to:

receive a configuration overriding the tenant-based receiver access policy; and

in response to receiving the configuration overriding the tenant-based receiver access policy, reject a multicast join request for joining the multicast group for the multicast service from an interface of the plurality of multicast receiver routers that is associated with the at least one receiver tenant specified by the tenant-based receiver policy.

15. The router of claim 11 , wherein the controller is configured to transmit membership query messages on interfaces associated with the at least one receiver tenant specified by the tenant-based receiver policy.

16. The router of claim 11 , wherein the controller is configured to drop membership report messages received from an interface of the plurality of multicast receiver routers that is not associated with the at least one receiver tenant specified by the tenant-based receiver access policy.

17. The router of claim 11 , wherein the controller is configured to replicate the packets for the multicast service by transmitting the packets as unicast packets for the multicast service to each multicast receiver router associated with the at least one receiver tenant specified by the tenant-based receiver access policy.

18. The router of claim 11 , wherein the controller is configured to:

join a multicast tree; and

transmit a multicast packet as a unicast packet to each multicast receiver router of the plurality of multicast receiver routers.

19. A method for providing multicast access control, the method comprising:

providing, by a plurality of routers, a multicast service, wherein the plurality of routers comprise a multicast source router and a plurality of multicast receiver routers; and

enforcing, by the plurality of routers, multicast access control policies for the multicast service, wherein the multicast access control policies comprise:

a tenant-based receiver access policy that specifies at least one receiver tenant allowed to receive packets from the multicast service; and

a sender access policy that specifies the multicast source router as allowed to send packets to the multicast service for distribution to the specified at least one receiver tenant, and

accepting, by the plurality of routers and based on the multicast access control policies, multicast join requests for joining a multicast group for the multicast service only from interfaces of the plurality of multicast receiver routers that are associated with the at least one receiver tenant specified by the tenant-based receiver policy.

20. The method of claim 19 ,

wherein the sender access policy comprises a tenant-based sender access policy that specifies at least one source tenant allowed to send packets to the multicast service,

wherein the method further comprises accepting, by the plurality of routers, packets sent to the multicast service only from interfaces of the multicast source router that are associated with the at least one source tenant specified by the tenant-based sender policy.

21. The method of claim 19 , further comprising:

receiving, by the plurality of routers, a configuration overriding the tenant-based receiver access policy; and

in response to receiving the configuration overriding the tenant-based receiver access policy, accepting, by the plurality of routers, a multicast join request for joining the multicast group for the multicast service from an interface of the plurality of multicast receiver routers that is not associated with the at least one receiver tenant specified by the tenant-based receiver policy.

22. The method of claim 19 , further comprising:

receiving, by the plurality of routers, a configuration overriding the tenant-based receiver access policy; and

in response to receiving the configuration overriding the tenant-based receiver access policy, rejecting, by the plurality of routers, a multicast join request for joining the multicast group for the multicast service from an interface of the plurality of multicast receiver routers that is associated with the at least one receiver tenant specified by the tenant-based receiver policy.

23. The method of claim 19 , further comprising transmitting, by the plurality of routers, membership query messages on interfaces associated with the at least one receiver tenant specified by the tenant-based receiver policy.

24. The method of claim 19 , further comprising dropping, by the plurality of routers, membership report messages received from an interface of the plurality of multicast receiver routers that is not associated with the at least one receiver tenant specified by the tenant-based receiver access policy.

25. The method of claim 19 , further comprising replicating, by the multicast source router, the packets for the multicast service by transmitting the packets as unicast packets for the multicast service to each multicast receiver router associated with the at least one receiver tenant specified by the tenant-based receiver access policy.

26. The method of claim 19 , further comprising:

joining, by the multicast source router, a multicast tree for the multicast service; and

transmitting, by the multicast source router, a multicast packet as a unicast packet to each multicast receiver router of the plurality of multicast receiver routers.