New Member

Question

Multicast Routing over MPLS - join multicast group behind a Fortigate fails

Forum|Forum|3 years ago
March 30, 2023
8 replies
4677 views

Hi,

I'm actually a beginner in Multicast Routing and could need some help with the configuration of a FortiGate 60F Firewall. My goal is actually to configure R-GOOSE.

FortiGate 60F v7.2.3

Cisco Router: IR1101-K9 (IOS XE 17.06.04)
Cisco Switch: IE-3400-SP2S (IOS XE 17.09.02)

R-GOOSE is a version of the popular IEC 61850 peer-to-peer communications method that can be used for wide-area protection and control applications. While the principles remain the same, R-GOOSE uses UDP multicast as the transport mechanism.

R-GOOSE Applications in a Smart Grid (Dr. Alexander Apostolov)

My lab spreads over multiple sites, connected over MPLS Layer 3 VPN. Between PE and CE i'm using OSPF on all sites with the same VRF. In the MPLS Core i'm using OSPF for the Underlay Network.

Screenshot 2023-03-30 180654.png

To get multicast running over MPLS i followed the instructions from cisco. cisco link

I'm using PIM sparse-mode and configured a Rendezvous Point on both multicast routing domains. (VRF and MPLS CORE).

Multicast is working fine between the cisco routers. Here an example. The neighbour table of pim in my VRF and the test for multiple interfaces i joined to a multicast-address:

Here you can see that the firewall formed a pim neighbor with the R-PE16 router.

This is my actual multicast routing configuration on my fortigate:

Multicast Policy on FortiGate:

Screenshot 2023-03-30 185024.png

1) I've configured the wan1 interface, that is actually in the zone "DOMOT" with the multicast join of 239.1.1.1.

Ping's not arriving at that interface. PING is activated on the Interface settings.

2) I also configured a router an connected it to the cisco switch (VLAN30 Access Port).

From here i want to send and receive these GOOSE Messages. On the interface i joined the same multicast address 239.1.1.1.

How can i verify that the fortigate multicast router noticed about that host/router that wants the multicast traffic from 239.1.1.1?

3) I also receive some igmp debug messages on PE router. But these are looking like the multicast routing protocols. They are not allowed to be routed over multicast!

On the multicast routing table R-PE16, i can see there is an entry from the interface IP of the fortigate!

IGMP Snooping is enabled on the switch.

4) Did i miss something?

Thanks

Sergio

FortiGate

Anthony_E

Staff

Hello Sergio,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Best Regards

Anthony_E

Staff

Hello Sergio,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

Best Regards

djflynnuk

New Member

Did you find an answer - I think I have the exact same issue!

sergio7Author

New Member

Hi,

Not yet. I will inform you here if i solve the issue.

djflynnuk

New Member

thank you, likewise!

djflynnuk

New Member

Hi Sergio7,

not sure this will help you (but its helped) me, I've found removing the join-group statement entirely and using the static-group config instead works i.e.

config router multicast-flow
edit "a.b.c.d" (mcast group IP)
config flows
edit 1
set group-addr a.b.c.d (mcast group IP)
set source-addr a.b.c.d (mcast src IP)

config router multicast

config interface

edit "lan2"
set pim-mode sparse-mode
set static-group "a.b.c.d" (mcast group IP)
config igmp
set version 2
end

If I enable the join-group nothing works.

sergio7Author

New Member

Hi,

I've tested it today. For me it doesn't solve my problem. After reading following Technical Tip:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-a-static-IGMP-group-entry/ta-p/193090

It looks only necessary when the last device in the multicast group sends a "IGMP Leave Group message" to keep forwarding the multicast traffic on that port/interface.

Hmm will investigate further.

Thanks

djflynnuk

New Member

yes, its a static "always-on" binding. shame.

edit: completely removing the join-group "fixes" this - IGMP signalling works from an end host as you'd expect.

So now I have it running correctly with no static-group or join-group config and just an end host IGMP'ing.

edit "lan2"
set pim-mode sparse-mode
config igmp
set version 2

# get router info multicast igmp groups
IGMP Connected Group Membership
Group Address Interface Uptime Expires Last Reporter
<mcast-grp-ip> lan2 00:00:07 00:04:12 <lan-client-ip>

Best of luck!

Sign up

Login with SSO

Login to the community

Login with SSO