Technical Tip: How to send multicast packets to forward over a site-to-site VPN
Description
This article describes the requirement to forward multicast traffic across route based IPSec tunnel.
Because the tunnel is a dial-up tunnel, on dialup client, the SRC quick mode selector cannot be 0.0.0.0/0, and the quick mode selector does not take a multicast address, for example: 224.0.0.0/4 or 224.0.1.59/32, so multicast traffic cannot be passed over the tunnel as the tunnel proxy id does not cover the multicast address.
A common example of where this may be used is in a VOIP network requirement.
How to get multicast packets to forward over a site-to-site VPN? Assuming a site-to-site VPN tunnel has been set up in interface mode. Ping will traverse the tunnel without problems; however, multicast functions, say VOIP phones, cannot work correctly.
Scope
Affected products/releases: All.
Solution
Topology:
There are two options to correct this issue; either one of them will work:
- Instead of using dialup tunnel, use a DDNS tunnel so both sites can use 0.0.0.0/0 as the SRC and DST quick mode selector in phase2.
- Configure firewall address for multicast address 224.0.0.0/4 and create firewall address group to include it, and modify phase2 to use firewall address or address group name as quick mode selector.
Workaround:
- Create a firewall address definition for multicast(224.0.0.0/4) on both FortiGates.
- Create a firewall address group, Rob-Home, to include both Rob-Lan(192.168.99.0/24) and the multicast address as members.
- On the HQ site, modify the phase2 from CLI:
config vpn ipsec phase2-interface
set dst-addr-type name
set src-addr-type name
set dst-name "Rob-Home"
set src-name "all"
end
So now the phase2 looks like this:
7LS-FORTIGATE # sh vpn ipsec phase2-i Rob_Home_P2
set dst-addr-type name
set phase1name "Rob_Home"
set proposal 3des-sha1 3des-md5
set src-addr-type name
set dst-name "Rob-Home"
set src-name "all"
next
end
- On the Rob (remote) site, modify the phase2 from CLI:
set dst-addr-type name
set src-addr-type name
set dst-name "all"
set src-name "Rob-Home"
end
FWF60B3908627180 # sh vpn ipsec phase2-i 7LS-HQ-P2
set dst-addr-type name
set keepalive enable
set phase1name "7LS-HQ"
set proposal 3des-sha1 3des-md5
set src-addr-type name
set dst-name "all"
set src-name "Rob-Home"
next
end
Related articles:
