IPTV, multicast, IGMPv2

[FlavioB]

Hello everybody. I' m trying to get my setup done for viewing IPTV on my Entone-IPTV-Box. I dedicated to that box the dmz port of my FWF60C and the only policy ruling is " dmz-->wan1" without restrictions (any/any). I need to have IGMPv2 support and as from the FortiOS Manual (I' m on MR3-Patch5) all three versions are supported. What I achieved as a first step, is to enable " multicast-forwarding" via CLI: config system settings set multicast-forward enable end I also enabled multicast to pass either way with policies (dunno if it' s needed both ways): config firewall multicast-policy edit 1 set dstintf " wan1" set srcintf " dmz" next edit 2 set dstintf " dmz" set srcintf " wan1" next end Now I connected the box on the dmz port, powered it on and it got to a good point: it came up, took it' s IP from the DHCP (had to mess around with a DHCP option too!), downloaded an INI-File from an http-server, then contacted some other server and then it stays there forever. On the TV I simply see that it' s not going past step 11/20. IPTV-Provider told me that this means that multicast is not yet being passed through the firewall. With WireShark I could see that my box sends out a couple of IGMP " V2 Membership Report / Join group 233.60.157.112" (from my box IP 10.10.10.50 to 233.60.157.112) messages and immediately after this, it sends " V2 Leave Group 233.60.157.112" (from my box IP 10.10.10.50 to 224.0.0.2). I do not know where to look for, I' ve got no experience in multicast scenarios. Thus I' m asking here: anybody knows what' s missing in my setup? Is there a part about " multicast routing" which I should add? Any help will be very appreciated! Thanks and regards, F.

[FlavioB]

Hello again. You should be able to get the sketch from here: http://depositfiles.com/files/epp6ygmky Thanks again, F.

[emnoc]

okay simple diagram, not over complex. Where are the subscribers location at ? ( internal ?) Couldn' t you set up multicast-forwarding and be done with it? You obviously is not routing mcast back thru the internet unless you have a gre-tunnel or something other tunneling method. Now the problem that you previously ran into; With out group controls, a internal host could easily oversubscribed the link bandwidth. If you have un-warrant IGMP subscriptions up ( IPTV channels ) and the combined total exceed the link capacity, they you drown out your other unicast traffic. Also make sure you run this in a pim-sparse mode to prevent the unecessary flood/prune that multicast-dense mode offers. I hope that helps.

[FlavioB]

Hello again. What do you mean by " subscribers location" ? I' ve already set up " multicast-forwarding" , but it didn' t help: config system settings set multicast-forward enable set multicast-ttl-notchange enable end config firewall multicast-policy edit 1 set dstintf " wan1" set srcintf " dmz" next edit 2 set dstintf " dmz" set srcintf " wan1" next end I' m running in PIM-SM. I feel that some Rendezvous Point is missing somewhere, as far as I understand. That RP would handle the requests for what stream to let pass through the firewall (routed). What do you think? Regards, F.

[emnoc]

Okay let' s start from the top; The IPTV box is it an adapter for your TV? or server some other role ? How does it get it' s content ? Is the content provided by your service provider? Is that the WAN? if it' s WAN1, do you see any mcast queriers within the WAN connection? ( diag sniffer packet or tcpdump igmp ) If you do have this, than your IPTV box must subscribed to this and ask for the channel and listing using IGMP and subscriptions to at least 233.60.157.112. The FGT needs to forward that request out and thru the WAN. The best bet is for the FGT to proxy the IGMP request(s) from IPTV device to your upstream? Does the IPTV device works when not behind the FGT device? Do you have any problems with link saturation for the mcast data? It will or could saturated the WAN connection depending on the content being delievered. So keep that in mind. Lastly, if the IPTV device is an adapterized to your TV, do you really need to secure it in a DMZ?

[FlavioB]

ORIGINAL: emnoc Okay let' s start from the top; The IPTV box is it an adapter for your TV? or server some other role ?

The IPTV box is a Set-Top Box with Ethernet connection and HDMI connection (to the TV). It is a client role.

How does it get it' s content ?

It gets an IP Address from the DHCP server on my LAN, asks for an ini file from a remote webserver, then starts to join multicast groups.

Is the content provided by your service provider?

Yes, although my ISP gets the contents from an IPTV-Provider (netstream.com).

Is that the WAN?

Yes, it' s wan1.

if it' s WAN1, do you see any mcast queriers within the WAN connection? ( diag sniffer packet or tcpdump igmp ) If you do have this, than your IPTV box must subscribed to this and ask for the channel and listing using IGMP and subscriptions to at least 233.60.157.112. The FGT needs to forward that request out and thru the WAN. The best bet is for the FGT to proxy the IGMP request(s) from IPTV device to your upstream? Does the IPTV device works when not behind the FGT device? Do you have any problems with link saturation for the mcast data? It will or could saturated the WAN connection depending on the content being delievered. So keep that in mind. Lastly, if the IPTV device is an adapterized to your TV, do you really need to secure it in a DMZ?

About the last thing (dmz): it is only the " dmz port" of the Fortigate unit, just to separate it from my WLAN/LAN and being able to test it with its own DHCP (I also needed to set domain name and a DHCP option to get it work). What I see is this: FWF60C-Bonny # get router info multicast igmp groups IGMP Connected Group Membership Group Address Interface Uptime Expires Last Reporter 224.0.1.140 wan1 22:58:24 00:04:02 84.55.249.100 233.60.157.101 wan1 22:58:30 00:04:01 84.55.249.100 233.60.157.102 wan1 22:58:30 00:04:01 84.55.249.100 233.60.157.112 wan1 22:58:30 00:04:02 84.55.249.100 239.129.0.2 wan1 00:57:08 00:04:02 84.55.249.100 224.0.1.140 dmz 01d20h59m 00:04:04 10.10.10.1 233.60.157.102 dmz 01d20h58m 00:04:11 10.10.10.50 239.129.0.2 dmz 00:52:48 00:04:04 10.10.10.50 239.129.0.4 dmz 00:01:06 00:04:01 10.10.10.50 As you can see, the IPTV box (dmz-port) asks for some multicast group to join and wan1 permits that. The multicasts on 239.129.0.x are the streams for each single tv channel (.2 is channel 2, .4 is channel 4, and so on). I could achieve the above result by manually adding some multicast IPs, which IS NOT my goal. Also, if I add more then 2 streams/multicast IPs, then I get saturated and nothing works anymore (which is obvious, as my Fortigate is then passing down to the dmz MANY streams at the same time, but I can watch only 1 channel at a time!) ;-) So, what else? I' m almost getting desperate, but not willing to give up as Fortigate is for sure able to handle this kind of setup. Regards, F.