Skip to main content
Dallas
New Member
January 11, 2013
Question

VLAN & Multicasting

  • January 11, 2013
  • 5 replies
  • 7600 views
Hi All, looking for some help, I have a network setup and I have VLAN' d the environment using the fortigate 110c as the router, when I run a multicast I get flooding happening across the entire network, any suggestions where to start looking? cheers

    5 replies

    emnoc
    New Member
    January 11, 2013
    Yeah do you have switches that do igmp snooping? What mcast address is flooding your network? What multicast protocol are you using? ( dense sparse ) What version of code are you using? How did you enable mcast and mcast routing + policies ?
    Dallas
    DallasAuthor
    New Member
    January 11, 2013
    the core switch is a HP 8212 it does have IGMP enabled... I am using PIM-Dense mode I am using v4.0,build0639,120906 (MR3 Patch 10) I enabled multicasting using the web interface, I created the policies the same way
    emnoc
    New Member
    January 11, 2013
    SO COOL, but what about the mcast grp ( dst_address) Can you give us a snippet of the groups and traffic? show firewall multicast-policy get firewall multicast-policy
    Dallas
    DallasAuthor
    New Member
    January 13, 2013
    this is the outpu of sh firewall multicast-policy config firewall multicast-policy edit 1 set dstintf " switch" set srcintf " L_Block" next edit 2 set dstintf " L_Block" set srcintf " switch" next edit 3 set dstintf " switch" set srcintf " A_Block" next edit 4 set dstintf " A_Block" set srcintf " switch" next edit 5 set dstintf " switch" set srcintf " Admin" next edit 6 set dstintf " Admin" set srcintf " switch" next edit 7 set dstintf " switch" set srcintf " B_Block" next edit 8 set dstintf " B_Block" set srcintf " switch" next edit 9 set dstintf " switch" set srcintf " E_Block" next edit 10 set dstintf " E_Block" set srcintf " switch" next edit 11 set dstintf " switch" set srcintf " G_Block" next edit 12 set dstintf " G_Block" set srcintf " switch" next edit 13 set dstintf " switch" set srcintf " H-Block" next edit 14 set dstintf " H-Block" set srcintf " switch" next edit 15 set dstintf " switch" set srcintf " ICTServices" next edit 16 set dstintf " ICTServices" set srcintf " switch" next edit 17 set dstintf " switch" set srcintf " S_Block" next edit 18 set dstintf " S_Block" set srcintf " switch" next edit 19 set dstintf " switch" set srcintf " Staff" next edit 20 set dstintf " Staff" set srcintf " switch" next end
    emnoc
    New Member
    January 15, 2013
    So what mcast groups are you allowing? And the one(s) that flooding everything? Also if your switch is truely set for igmp snooping it should see your firewall as a mcast-router and show all unique subscriptions to the hosts. I would do a diag sniffer with the keyowrd igmp ( pro to 1 ) and make sure that igmp is working correctly. You Also need to review your mcast-fwpolicies for the correct SRCs and DSTs.
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.