Multicast routing / IGMP snooping

Question

Dear all, i wanted to improve my multicast traffic enabling IGMP snooping and multicast routing. I am using a Fortigate 40F (7.2.10) together with a Fortiswitch 108F and FortiAP 231G. Before, multicast between my VLANS (ports are on NAC mode) worked perfectly, but now I am lost and I do not know what I am doing wrong...

Here some information out of my CLI:

FortiGate40F (settings) # show
config system settings
set multicast-ttl-notchange enable
set gui-multicast-policy enable
set gui-dos-policy enable
set gui-local-in-policy enable
set gui-dynamic-routing enable
set gui-advanced-wireless-features enable
set gui-email-collection enable
set gui-multiple-interface-policy enable

FortiGate40F # get switch-controller igmp-snooping
aging-time : 300
flood-unknown-multicast: disable
query-interval : 125

FortiGate40F # diag switch-controller switch-info igmp-snooping group
S108F***********:
IGMP-SNOOPING learned mcast-groups:
port VLAN GROUP Age-timeout IGMP-Version
GT40F*** 20 querier 120 V2
GT40F*** 25 querier 120 V2
GT40F*** 30 querier 120 V2
GT40F*** 35 querier 120 V2
GT40F*** 50 querier 120 V2
GT40F*** 100 querier 120 V2
Total IGMP Hosts: 0

FortiGate40F # show router multicast
config router multicast
set multicast-routing enable
config pim-sm-global
config rp-address
edit 1
set ip-address 10.10.50.1
next
edit 2
set ip-address 10.10.35.1
next
end
end
config interface
edit "VLAN1"
set pim-mode sparse-mode
config igmp
set version 2
end
next
edit "VLAN2"
set pim-mode sparse-mode
config igmp
set version 2
end
next
edit "VLAN3"
set pim-mode sparse-mode
config igmp
set version 2
end
next
edit "VLAN4"
set pim-mode sparse-mode
config igmp
set version 2
end
next
edit "VLAN5"
set pim-mode sparse-mode
config igmp
set version 2
end
next
edit "VLAN6"
set pim-mode sparse-mode
config igmp
set version 2
end
next
edit "VLAN7"
set pim-mode sparse-mode
config igmp
set version 2
end
next
edit "VLAN8"
set pim-mode sparse-mode
config igmp
set version 2
end
next
end
end

FortiGate40F # diag sys mcast-session list

session info: id=764556 vf=0 proto=17 10.10.35.11.3423->239.255.255.250.3423
used=2 path=1 duration=26 expire=160 indev=31 pkts=11 bytes=1023
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=35/35 in_npuid=1 tae_index=138904 qid=2 fwd_map=0x00000000
path: offloaded policy=2, outdev=33, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=35/35 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764557 vf=0 proto=17 10.10.35.11.62744->239.255.255.250.1900
used=2 path=1 duration=26 expire=157 indev=31 pkts=11 bytes=1718
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=35/35 in_npuid=1 tae_index=138903 qid=1 fwd_map=0x00000000
path: offloaded policy=2, outdev=33, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=35/35 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764518 vf=0 proto=17 10.10.50.11.53172->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33 pkts=2 bytes=1263
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138892 qid=3 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764519 vf=0 proto=17 10.10.50.11.52886->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33 pkts=2 bytes=1319
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138893 qid=0 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764520 vf=0 proto=17 10.10.50.11.49855->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764521 vf=0 proto=17 10.10.50.11.42803->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764522 vf=0 proto=17 10.10.50.11.45360->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764523 vf=0 proto=17 10.10.50.11.42844->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764524 vf=0 proto=17 10.10.50.11.34041->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33 pkts=2 bytes=1319
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138894 qid=0 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764525 vf=0 proto=17 10.10.50.11.45338->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764526 vf=0 proto=17 10.10.50.11.54154->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764527 vf=0 proto=17 10.10.50.11.35196->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764528 vf=0 proto=17 10.10.50.11.57237->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33 pkts=2 bytes=1313
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138895 qid=0 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764529 vf=0 proto=17 10.10.50.11.37430->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764530 vf=0 proto=17 10.10.50.11.43073->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33 pkts=2 bytes=1315
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138896 qid=0 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764531 vf=0 proto=17 10.10.50.11.56132->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764532 vf=0 proto=17 10.10.50.11.54119->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764533 vf=0 proto=17 10.10.50.11.59596->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33 pkts=2 bytes=1263
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138897 qid=2 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764534 vf=0 proto=17 10.10.50.11.39906->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33 pkts=2 bytes=1319
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138898 qid=0 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764535 vf=0 proto=17 10.10.50.11.54441->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764536 vf=0 proto=17 10.10.50.11.45330->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764537 vf=0 proto=17 10.10.50.11.56649->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764538 vf=0 proto=17 10.10.50.11.40363->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764539 vf=0 proto=17 10.10.50.11.57427->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33 pkts=2 bytes=1319
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138899 qid=0 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764540 vf=0 proto=17 10.10.50.11.51601->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764541 vf=0 proto=17 10.10.50.11.56163->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764542 vf=0 proto=17 10.10.50.11.50032->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764543 vf=0 proto=17 10.10.50.11.39202->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33 pkts=2 bytes=1313
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138900 qid=0 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764544 vf=0 proto=17 10.10.50.11.47272->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764545 vf=0 proto=17 10.10.50.11.58503->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33 pkts=2 bytes=1315
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138901 qid=2 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764546 vf=0 proto=17 10.10.50.11.40070->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764547 vf=0 proto=17 10.10.50.11.54741->239.255.255.250.1900
used=2 path=2 duration=37 expire=142 indev=33
state=00000008:offloadable
session-npu-info: ipid/vlifid=0/0 vlanid/vtag_in=0/0 in_npuid=0 tae_index=0 qid=0 fwd_map=0x00000000
path: policy=15, outdev=27, tos=0xff
path: policy=6, outdev=31, tos=0xff

session info: id=764560 vf=0 proto=17 10.10.50.11.3423->239.255.255.250.3423
used=2 path=2 duration=19 expire=161 indev=33 pkts=2 bytes=248
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npuid=1 tae_index=138905 qid=2 fwd_map=0x00000000
path: offloaded policy=15, outdev=27, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0
path: offloaded policy=6, outdev=31, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=50/50 in_npu_id=1, out_npuid=1 epid=71 fwd=0

session info: id=764548 vf=0 proto=17 10.10.20.10.1900->239.255.255.250.1900
used=2 path=1 duration=34 expire=145 indev=27 pkts=2 bytes=677
state=00000018:offloadable npu-info
session-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=20/20 in_npuid=1 tae_index=138902 qid=2 fwd_map=0x00000000
path: offloaded policy=16, outdev=33, tos=0xff
act-npu-info: ipid/vlifid=71/71 vlanid/vtag_in=20/20 in_npu_id=1, out_npuid=1 epid=71 fwd=0
Total 34 sessions

I would very appreciate if someone could help me indicating/finding the issue.

Thanks!

akileshc · Answer

Hello Patron85,With the details provided, I understand the below points in terms of current configuration.   1. Multicast Routing and IGMP Snooping:- Multicast routing is enabled on your FortiGate.- IGMP snooping is configured with a query interval of 125 seconds and an aging time of 300 seconds.- PIM sparse mode is set on multiple VLANs with IGMP version 2.   2. Session Information:- The session information shows multicast traffic being offloaded, indicating that the FortiGate is processing multicast traffic efficiently.   Considering the issue description and configuration setup explains, the below troubleshooting steps can be followed to further isolate the issue.   1. Verify IGMP Snooping Configuration:- Ensure that IGMP snooping is enabled on all relevant VLANs on the FortiSwitch. This can be done via the FortiGate interface configuration or directly on the FortiSwitch if managed separately.- Use the command `get switch igmp-snooping group` on the FortiSwitch to verify that multicast groups are being learned correctly.   2. Check Multicast Policy:- Ensure that multicast policies are correctly configured to allow traffic between VLANs. This can be done under `Policy & Objects -> Multicast Policy` in the FortiGate GUI.- Verify that the multicast address range is allowed in the policy.   3. Review PIM Configuration:- Ensure that the PIM configuration is correct and that the RP (Rendezvous Point) addresses are reachable and correctly set for the multicast groups.- Use the command `get router info multicast pim sparse-mode neighbour` to check PIM neighbor relationships.   4. Monitor Multicast Traffic:- Use the command `diagnose sys mcast-session list` to monitor active multicast sessions and ensure they are being processed as expected.- Check for any dropped packets or errors in the session list.   5. Check FortiAP Configuration:- Ensure that the FortiAP is configured to handle multicast traffic correctly. This may involve enabling multicast enhancements or IGMP snooping on the wireless network.   It could be better to understand, If you could clarify some questions mentioned below: - Are there any specific error messages or logs indicating issues with multicast traffic?- Have there been any recent changes to the network configuration that might have affected multicast routing?- Are there any specific applications or devices experiencing multicast issues, or is it a general problem across the network?

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded