FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
pjang
Staff & Editor
Staff & Editor
Article Id 259036
Description

This article discusses a previously undocumented limitation about how many interfaces can be set when configuring Multicast Routing on the FortiGate (i.e., via PIM sparse-mode).

 

The article also discusses the functional effects of this limitation, the long-term solution, and available workarounds. Note that this is not to be confused with Multicast Forwarding, which is a similar but separate function.

Scope

FortiOS v7.4.0 and older (FortiOS v7.4.1 introduces small but relevant changes).

Solution

On the FortiGate GUI, interfaces can be added under Network -> Multicast -> Interfaces to enable them for IGMP and PIM-based Multicast Routing functionality. The CLI equivalent can be found under config router multicast.

 

Technically speaking, there is no limit to the number of interface entries that may be added here by an administrator. However, there is a functional limit of 31 interfaces that applies here. Any interface beyond the 31st interface that an administrator adds here will be added to the config, but will not work for Multicast Routing.

 

The limitation can be observed using the command get router info multicast pim sparse-mode interface. It can be noticed that only 31 interface entries are listed by this command, even when 32 or more interfaces have been configured.

Any interfaces not included in the output of the above command will exhibit the following general behavior:

 

  • IGMP will work correctly and will identify local Sources/Receivers for a given Multicast Group.
  • However, PIM-SM will not add interfaces as joined receivers for any multicast groups, nor will it add (S, G) routes for a source/speaker.
  • Ultimately, the non-included interfaces will not function for multicast routing and will not be able to send/receive multicast traffic to/from other subnets.

 

As of Bug #910071, a fix has been scheduled for FortiOS v7.4.1, where the functional limit will be increased from 31 interfaces to 256 interfaces.

 

Workaround.

Administrators are recommended to limit their total configured Multicast Routing interfaces to 31 interfaces or fewer. If more than 31 interfaces have been configured, then the following procedure is recommended:

 

  1. Delete any non-essential interfaces from the Multicast Routing config until the number of remaining interfaces is 31 or fewer.

  2. Run exec router restart to have the FortiGate re-read the Multicast Routing config and import any previously-missing interfaces:

 

  • The above command is required because the FortiGate does not automatically pull in the missing interfaces when others are deleted (for example, if having 32 configured interfaces and deleting port31 to make room for port32, port32 will still not work until the above command is run, nor will it show in the output of get router info multicast pim sparse-mode interface).

 

  • Caution: the above command restarts the routing software in general, and this can cause network disruptions if relying on routes obtained via BGP and other dynamic routing protocols. It is recommended to minimize disruption by running this command outside of business hours (i.e., during a maintenance window).

 

Note: PIM Sparse mode is not supported to operate with a non-default VRF. It supports VRF 0. Some new features were introduced in v7.6.1. The following document can be configured in VRF:

Multicast routing and PIM support