New Member

Question

IPTV, multicast, IGMPv2

Forum|Forum|14 years ago
March 5, 2012
14 replies
29511 views

Hello everybody. I' m trying to get my setup done for viewing IPTV on my Entone-IPTV-Box. I dedicated to that box the dmz port of my FWF60C and the only policy ruling is " dmz-->wan1" without restrictions (any/any). I need to have IGMPv2 support and as from the FortiOS Manual (I' m on MR3-Patch5) all three versions are supported. What I achieved as a first step, is to enable " multicast-forwarding" via CLI: config system settings set multicast-forward enable end I also enabled multicast to pass either way with policies (dunno if it' s needed both ways): config firewall multicast-policy edit 1 set dstintf " wan1" set srcintf " dmz" next edit 2 set dstintf " dmz" set srcintf " wan1" next end Now I connected the box on the dmz port, powered it on and it got to a good point: it came up, took it' s IP from the DHCP (had to mess around with a DHCP option too!), downloaded an INI-File from an http-server, then contacted some other server and then it stays there forever. On the TV I simply see that it' s not going past step 11/20. IPTV-Provider told me that this means that multicast is not yet being passed through the firewall. With WireShark I could see that my box sends out a couple of IGMP " V2 Membership Report / Join group 233.60.157.112" (from my box IP 10.10.10.50 to 233.60.157.112) messages and immediately after this, it sends " V2 Leave Group 233.60.157.112" (from my box IP 10.10.10.50 to 224.0.0.2). I do not know where to look for, I' ve got no experience in multicast scenarios. Thus I' m asking here: anybody knows what' s missing in my setup? Is there a part about " multicast routing" which I should add? Any help will be very appreciated! Thanks and regards, F.

emnoc

New Member

Do you have a IGMP querier on that interface? If you don' t that might be a problem unless the fortinet gate igmp proxy. Do a dump for igmp on your host , plus minus your host address and seee if you ahve any other igmp traffic from anybody.

FlavioBAuthor

New Member

Hello emnoc, glad to see that at least somebody has dropped its " 2 cents" on my thread :-) As I am a perfect newbie in this multicast/IGMP thing, could you please explain any deeper what I should have/do? BTW: on my host (my TV Box) I can' t do any dump/sniffing, the only place I am able to do it, is on the Fortigate itself. Thanks and kind regards, F.

emnoc

New Member

You need to ensure your have a IGMP subscription and that a IGMP query enable for that subent. > if the iptv host is a unix box, the netstat -g cmd will show your subscriptions [emnoc@venusfly ~]$ netstat -ng IPv6/IPv4 Group Memberships Interface RefCnt Group --------------- ------ --------------------- lo 1 224.0.0.1 eth0 1 224.0.0.251 eth0 1 224.0.0.1 lo 1 ff02::1 eth0 1 ff02::fb eth0 1 ff02::1:ffc4:be1a eth0 1 ff02::1 eth5 1 ff02::fb eth5 2 ff02::1:ff40:8112 eth5 1 ff02::1 eth6 1 ff02::fb eth6 1 ff02::1:ff40:80a5 eth6 1 ff02::1 eth7 1 ff02::fb eth7 1 ff02::1:ff40:80a4 eth7 1 ff02::1 eth8 1 ff02::fb eth8 1 ff02::1:ff40:80a7 eth8 1 ff02::1 > for windows, I don' t know of any reasonable way to find your subscriptions Next, To look for a igmp querier, execute the following; tcpdump igmp or for wireshark you can use a display filter of igmp also. I guess you could do the same on the diagnostic packet sniffer on the FGT and specify the lan interface where the IPTV host(s) sits. btw: If you have no querier , than this is going to break your multicast_forwarder. Also, if you have a l2 switch that support igmp-snooping, this would break also.

FlavioBAuthor

New Member

OK, here I try to go... 2012-03-12 19:34:02.397547 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:04.723291 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:08.485210 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:11.957075 10.10.10.1 -> 224.0.0.1: ip-proto-2 8 2012-03-12 19:34:12.190978 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:14.816865 10.10.10.1 -> 224.0.0.13: ip-proto-2 8 2012-03-12 19:34:15.676842 10.10.10.1 -> 224.0.1.140: ip-proto-2 8 2012-03-12 19:34:17.424124 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:34:17.424385 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:34:17.424473 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:34:17.425463 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:17.425882 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:17.426228 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:18.417055 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:18.433812 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:21.226998 10.10.10.1 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:34:28.113179 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:30.906262 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:33.459674 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:34:33.459806 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:34:33.459878 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:34:33.460767 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:33.461156 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:33.461500 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:34.457045 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:34.475040 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:42.599168 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:49.499908 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:34:49.500033 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:34:49.500102 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:34:49.500999 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:49.501388 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:49.501734 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:50.497045 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:50.507177 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:50.552195 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:34:54.822448 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:35:05.532266 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:35:05.532402 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:35:05.532474 10.10.10.50 -> 224.0.0.2: ip-proto-2 8 2012-03-12 19:35:05.533358 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:35:05.533750 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:35:05.534092 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:35:06.527046 10.10.10.1 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:35:06.539416 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 2012-03-12 19:35:16.358880 10.10.10.50 -> 233.60.157.112: ip-proto-2 8 What you see: 10.0.0.50 is my TV-Box 10.0.0.1 is the IP of my Fortigate' s DMZ-Port, on which I connected the TV-Box. Can you now help me debugging further? Many thanks! F.

emnoc

New Member

Can you get a debug off the firewall or host for IGMP on the external side? ( protocol #2 ) You want to see an IGMP query every 60 or 120 secs for group membership. Also where does the IPTV sender sits at in relation to the firewall ( DMZ or WAN ), I' m not 100% clear on this? but guess it' s on DMZ? If yes, than the receivers are on WAN1 ? Where ever these 2 party sits at, you need to check for the groups and igmp being enable.If your have a igmp-snooping switch, it will need a querier on all subnet or vlans. To break it all down; 1: do a sniffer on the subnet/vlan that holds the IPTV sender 2: do a sniffer on the subnet/vlan that holds the IPTV receiver 3: ensure igmp-snooping is off ( for test purpose ) and if you need it, than ensure a igmp querier is enable in that subnet 4: for the IPTV sender, make sure; a: the fwpolicy is allow from it to sende ( I' m confident you have that done ) b: that the IPTV sender TTL is not expiring B4 it forward thru 5: run a diag debug flow to triple check 6: run a netstat -ng to ensure your actively subscribing to a mcast group ( linux ) or get the netsh.exe ( windows ) 7: lastly, ensure the client is looking at the right port# of that group.

FlavioBAuthor

New Member

Hello emnoc. Sorry for getting back late... I made some progress in my setup, yeah! I' ve added to the external (wan1) interface individual IPs on the multicast router config. It now looks like this: config router multicast config interface edit " dmz" set pim-mode sparse-mode config igmp set version 2 end next edit " wan1" set pim-mode sparse-mode config join-group edit 233.60.157.112 next edit 233.60.157.102 next edit 233.60.157.101 next edit 239.129.10.2 next edit 239.129.10.1 next edit 224.0.1.140 next end config igmp set version 2 end next end set multicast-routing enable end The multicast IPs 239.129.10.1 and .2 are channels 1 and 2 of my set top box, nice! If I add .3 and .4 (just 2 more) the stream is cut off, sliced audio and video happening. I guess this is because I' m enabling *at the same time* more than 1 stream down to my IPTV box, what do you think? Thus, I' m still looking to get this thing correctly working. First of all, I guess there should be some sort of " dynamic" in the system, which allows the IPTV box to switch from one stream to another without leaving the first stream " open" , do you get what I mean? How do you think this could be achieved? I don' t want to add every and each single channel I' d like to have on my IPTV box in the config, you agree? Thanks and regards, F.

emnoc

New Member

Can you draw a sketch of the network layout? What you did in the above cfg was to set the firewall as a igmp subscriber. This might not be good. e.g config join-group edit 233.60.157.112 next edit 233.60.157.102 next edit 233.60.157.101 next edit 239.129.10.2 next edit 239.129.10.1 next edit 224.0.1.140 next end If you have no active subscriber, than the firewall is still subscribing for data that has no active subscriptions. Eating up your bandwidth and cpu/memory.

FlavioBAuthor

New Member

Hello emnoc, your words have shed some light :-) In fact it is as you described: the IPTV box asks on the " dmz" interface to join that IGMP group (239.129.10.1 is channel 1, 239.129.10.2 is channel 2, and so on). If I open *more* than 2 of these (configure join-group on the wan1 interface), then my TV experience is deteriorating in a few seconds (as you said, the firewall is getting data which is *not* needed). My goal would be to have some sort of " dynamic" subscription of my firewall, do you understand? The sketch will be posted soon, sorry... Many thanks! F.

emnoc

New Member

Awaiting for a sketch. FWIW I' ve never been very impress with mcast routing and firewalls. Typical I' ve set a cisco router as a mcast termination device and pretty much lock it down. What you really need is for the fgt to proxy the IGMP request and handle the igmp subscriptions.

FlavioBAuthor

New Member

Hello again. You should be able to get the sketch from here: http://depositfiles.com/files/epp6ygmky Thanks again, F.

emnoc

New Member

okay simple diagram, not over complex. Where are the subscribers location at ? ( internal ?) Couldn' t you set up multicast-forwarding and be done with it? You obviously is not routing mcast back thru the internet unless you have a gre-tunnel or something other tunneling method. Now the problem that you previously ran into; With out group controls, a internal host could easily oversubscribed the link bandwidth. If you have un-warrant IGMP subscriptions up ( IPTV channels ) and the combined total exceed the link capacity, they you drown out your other unicast traffic. Also make sure you run this in a pim-sparse mode to prevent the unecessary flood/prune that multicast-dense mode offers. I hope that helps.

FlavioBAuthor

New Member

Hello again. What do you mean by " subscribers location" ? I' ve already set up " multicast-forwarding" , but it didn' t help: config system settings set multicast-forward enable set multicast-ttl-notchange enable end config firewall multicast-policy edit 1 set dstintf " wan1" set srcintf " dmz" next edit 2 set dstintf " dmz" set srcintf " wan1" next end I' m running in PIM-SM. I feel that some Rendezvous Point is missing somewhere, as far as I understand. That RP would handle the requests for what stream to let pass through the firewall (routed). What do you think? Regards, F.

emnoc

New Member

Okay let' s start from the top; The IPTV box is it an adapter for your TV? or server some other role ? How does it get it' s content ? Is the content provided by your service provider? Is that the WAN? if it' s WAN1, do you see any mcast queriers within the WAN connection? ( diag sniffer packet or tcpdump igmp ) If you do have this, than your IPTV box must subscribed to this and ask for the channel and listing using IGMP and subscriptions to at least 233.60.157.112. The FGT needs to forward that request out and thru the WAN. The best bet is for the FGT to proxy the IGMP request(s) from IPTV device to your upstream? Does the IPTV device works when not behind the FGT device? Do you have any problems with link saturation for the mcast data? It will or could saturated the WAN connection depending on the content being delievered. So keep that in mind. Lastly, if the IPTV device is an adapterized to your TV, do you really need to secure it in a DMZ?

FlavioBAuthor

New Member

ORIGINAL: emnoc Okay let' s start from the top; The IPTV box is it an adapter for your TV? or server some other role ?

The IPTV box is a Set-Top Box with Ethernet connection and HDMI connection (to the TV). It is a client role.

How does it get it' s content ?

It gets an IP Address from the DHCP server on my LAN, asks for an ini file from a remote webserver, then starts to join multicast groups.

Is the content provided by your service provider?

Yes, although my ISP gets the contents from an IPTV-Provider (netstream.com).

Is that the WAN?

Yes, it' s wan1.

if it' s WAN1, do you see any mcast queriers within the WAN connection? ( diag sniffer packet or tcpdump igmp ) If you do have this, than your IPTV box must subscribed to this and ask for the channel and listing using IGMP and subscriptions to at least 233.60.157.112. The FGT needs to forward that request out and thru the WAN. The best bet is for the FGT to proxy the IGMP request(s) from IPTV device to your upstream? Does the IPTV device works when not behind the FGT device? Do you have any problems with link saturation for the mcast data? It will or could saturated the WAN connection depending on the content being delievered. So keep that in mind. Lastly, if the IPTV device is an adapterized to your TV, do you really need to secure it in a DMZ?

About the last thing (dmz): it is only the " dmz port" of the Fortigate unit, just to separate it from my WLAN/LAN and being able to test it with its own DHCP (I also needed to set domain name and a DHCP option to get it work). What I see is this: FWF60C-Bonny # get router info multicast igmp groups IGMP Connected Group Membership Group Address Interface Uptime Expires Last Reporter 224.0.1.140 wan1 22:58:24 00:04:02 84.55.249.100 233.60.157.101 wan1 22:58:30 00:04:01 84.55.249.100 233.60.157.102 wan1 22:58:30 00:04:01 84.55.249.100 233.60.157.112 wan1 22:58:30 00:04:02 84.55.249.100 239.129.0.2 wan1 00:57:08 00:04:02 84.55.249.100 224.0.1.140 dmz 01d20h59m 00:04:04 10.10.10.1 233.60.157.102 dmz 01d20h58m 00:04:11 10.10.10.50 239.129.0.2 dmz 00:52:48 00:04:04 10.10.10.50 239.129.0.4 dmz 00:01:06 00:04:01 10.10.10.50 As you can see, the IPTV box (dmz-port) asks for some multicast group to join and wan1 permits that. The multicasts on 239.129.0.x are the streams for each single tv channel (.2 is channel 2, .4 is channel 4, and so on). I could achieve the above result by manually adding some multicast IPs, which IS NOT my goal. Also, if I add more then 2 streams/multicast IPs, then I get saturated and nothing works anymore (which is obvious, as my Fortigate is then passing down to the dmz MANY streams at the same time, but I can watch only 1 channel at a time!) ;-) So, what else? I' m almost getting desperate, but not willing to give up as Fortigate is for sure able to handle this kind of setup. Regards, F.

Sign up

Login with SSO

Login to the community

Login with SSO