Technical Tip: Multicast traffic over site-to-site IPsec VPN without PIM
Description
The following high-level diagram illustrates the scenario:
Scope
FortiGate.
Solution
- Establish IPsec VPN tunnel between both FortiGates.
- Server side (subnet 10.167.0.0/22) should be able to reach the Client side (subnet 10.144.0.0/22).
- VLC player installed on the server and client side to simulate the stream.
- 'multicast-forward' should be enabled in both peers.
- 'multicast-router' must be disabled in both peers.
- 'multicast firewall policies' should be configured in both peers.
- The multicast traffic received on the ingress interface will not be forwarded over the tunnel if the TTL value is too small to go through the FortiGate (default value TTL=1). Therefore, it is necessary to enable 'multicast-ttl-notchange' or adjust the value in the server. In this scenario, 'multicast-ttl-notchange' was enabled in both peers.
Configuration Student - CLI Configuration:
VPN configuration:
config vpn ipsec phase1-interface
edit "tunneltoremote"
set interface "port1"
set proposal aes256-sha1
set dhgrp 5
set remote-gw 10.108.16.52
next
end
config vpn ipsec phase2-interface
edit "tunneltoremote"
set phase1name "tunneltoremote"
set proposal aes256-sha1
set dhgrp 5
next
end
Firewall policies:
config firewall policy
edit 2
set uuid 3f41d4ec-1b11-51e5-59e1-89ff338a8b48
set srcintf "port2"
set dstintf "tunneltoremote"
set srcaddr "10.167.0.0/22"
set dstaddr "10.144.0.0/22"
set action accept
set schedule "always"
set service "ALL"
next
edit 3
set uuid 4ecffd80-1b11-51e5-f9dc-b4973fcba126
set srcintf "tunneltoremote"
set dstintf "port2"
set srcaddr "10.144.0.0/22"
set dstaddr "10.167.0.0/22"
set action accept
set schedule "always"
set service "ALL"
next
end
Static Route:
config router static
edit 1
set gateway 10.108.19.254
set device "port1"
next
edit 2
set dst 10.144.0.0 255.255.252.0
set device "tunneltoremote"
next
end
Configuration multicast:
config system settings
set multicast-forward enable
set multicast-ttl-notchange enable
end
Firewall multicast policy:
config firewall multicast-policy
edit 1
set srcintf "port2"
set dstintf "tunneltoremote"
set srcaddr "all" <- Unicast address.
set dstaddr "all" <- Multicast address.
next
end
Remote Configuration - CLI Configuration:
Remote VPN configuration:
config vpn ipsec phase1-interface
edit "tunneltostudent"
set interface "port4"
set proposal aes256-sha1
set dhgrp 5
set remote-gw 10.108.16.137
next
end
config vpn ipsec phase2-interface
edit "tunneltostudent"
set phase1name "tunneltostudent"
set proposal aes256-sha1
set dhgrp 5
next
end
Firewall Policies:
config firewall policy
edit 16
set uuid d16f4a8a-1b10-51e5-3008-a5f532b77f5c
set srcintf "tunneltostudent"
set dstintf "port3"
set srcaddr "10.167.0.0/22"
set dstaddr "10.144.0.0/16"
set action accept
set schedule "always"
set service "ALL
next
edit 17
set uuid f4186fa8-1b10-51e5-3a14-f0414fd58617
set srcintf "port3"
set dstintf "tunneltostudent"
set srcaddr "10.144.0.0/16"
set dstaddr "10.167.0.0/22"
set action accept
set schedule "always"
set service "ALL"
next
end
Static routing:
config router static
edit 2
set dst 10.167.0.0 255.255.252.0
set device "tunneltostudent"
next
end
Multicast configuration:
config system settings
set multicast-forward enable
set multicast-ttl-notchange enable
end
Multicast policies:
config firewall multicast-policy
edit 1
set srcintf "tunneltostudent"
set dstintf "port3"
set srcaddr "all" <- unicast address.
set dstaddr "all" <- multicast address.
next
end
Note:
Multicast and Unicast IP addresses should be included on Phase2-interface of the tunnel. If not, the multicast traffic will not be passing through the tunnel.
To verify multicast flow on both sides, use the following command:
diagnose sys mcast-session list
