BM 3.5 SP3
ZfD 4.0.1 Image server

We have two different LANs, with a BM 3.5 SP3 between them.
In this case, the ZfD imaging server resides on the other side
of the BM than the PXE boot-clients receiving the image.
When running ZfD muticasted imaging, the session is stopped by the firewall.

PIM is running on the BM.
No entries are visable in the IP deny-logs.
When unloading IPFLT, everything works OK.

What are the filter exceptions for ZfD image multicasting?
(packet types, protocols, ports, address types)

I'd like to specify these filters, because the protected LAN
contains strictly confidential data, and I will avoid using
filter exceptions that are too generic and tolerable.

I have also submitted this question on the ZfD4 imaging forum,
but have not got any answer that helps me yet.
We are about to dump new images to a lot of clients on the
protected LAN. This deployment will take some time,
and that LAN should not lie unprotected during such a period.