This read-write bitmask defines ports that must never receive a specific IPv4 multicast group's traffic, overriding whatever dynamic IGMP learning would otherwise allow. An administrator uses this to explicitly block a multicast stream from reaching certain ports for security or bandwidth reasons, even if a device on that port sends an IGMP join. For example, adding a guest-network port to rlBrgStaticIpMulticastForbiddenPorts for an internal-only multicast group stops that stream from ever leaking to a device connected there.