Policy handling for multicast transmissions

A device comprising:

• a first interface to receive a unicast packet designating a unicast source and a unicast destination;
• a processor to:
• determine whether the unicast packet is a Data Register message,
• the Data Register message comprising a multicast packet encapsulated within the unicast packet,
• extract packet flow information relating to the multicast packet when the unicast packet is a Data Register message,
• the packet flow information identifying a flow associated with the multicast packet,
• perform a policy lookup based on the packet flow information,
• determine, based on performing the policy lookup, whether a policy, associated with the multicast packet, has been identified,
• drop the unicast packet when no policy, associated with the multicast packet, has been identified, and
• when a policy associated with the multicast packet has been identified:
• determine whether the identified policy authorizes forwarding of the unicast packet, and
• establish a multicast data session when the identified policy authorizes forwarding of the unicast packet;
• and
• a second interface to forward the unicast packet to the unicast destination when the multicast data session is established.

A system, comprising:

• a network security device to:
• receive, from a first network device, a unicast packet destined for a second network device,
• the first network device being associated with a multicast source provided in a first network, and
• the second network device being associated with a multicast group provided in a second network that is different than the first network;
• determine whether the received unicast packet is a Data Register message;
• extract information relating to a multicast packet encapsulated within the unicast packet, when the unicast packet is a Data Register message,
• the extracted information including:
• information identifying a source Internet Protocol (IP) address associated with the multicast packet,
• information identifying a multicast group destination IP address associated with the multicast packet,
• information identifying a source port associated with the multicast packet,
• information identifying a multicast group destination port associated with the multicast packet, and
• information identifying a protocol associated with the multicast packet;
• perform a security policy lookup based on the extracted information relating to the multicast packet to identify a security policy associated with the multicast packet;
• determine whether the identified security policy authorizes forwarding of the unicast packet;
• establish a multicast data session when the identified security policy authorizes forwarding of the unicast packet;
• establish a multicast control session based on the multicast data session,
• the multicast control session authorizing transmission of Protocol Independent Multicast (PIM)-related control messages associated with the multicast packet;
• and
• forward the unicast packet to the second network device based on establishing the multicast data session.