IPsec multicast join dropped (NAT mode)

[rorem]

Hi,

I have a 600E running 6.2.3 with an IPsec tunnel setup to a 600D (also running 6.2.3). I'm trying to get multicast (video) working to an ubuntu laptop connected to port 7 (IP 192.168.222.101) of the 600E. When the laptop sends an IGMP join to multicast 237.28.74.112 , the 600E drops the packet for some reason.

here's the debug output:

******

600E-station1 # di de enable

600E-station1 # id=20085 trace_id=1555 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=2, 192.168.222.101:0->237.28.74.112:0) from port7. " id=20085 trace_id=1555 func=init_ip_session_common line=5666 msg="allocate a new session-52af94f9" id=20085 trace_id=1555 func=iprope_dnat_check line=4882 msg="in-[port7], out-[]" id=20085 trace_id=1555 func=iprope_dnat_check line=4895 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000" id=20085 trace_id=1555 func=__iprope_check line=2128 msg="gnum-10000a, check-ffffffffa0026f20" id=20085 trace_id=1555 func=__iprope_check_one_policy line=1889 msg="checked gnum-10000a policy-1, ret-no-match, act-drop" id=20085 trace_id=1555 func=__iprope_check_one_policy line=1889 msg="checked gnum-10000a policy-2, ret-no-match, act-drop" id=20085 trace_id=1555 func=__iprope_check_one_policy line=1889 msg="checked gnum-10000a policy-4294967295, ret-matched, act-drop" id=20085 trace_id=1555 func=__iprope_check_one_policy line=2099 msg="policy-4294967295 is matched, act-drop" id=20085 trace_id=1555 func=__iprope_check line=2147 msg="gnum-10000a check result: ret-matched, act-drop, flag-00000800, flag2-00000000" id=20085 trace_id=1555 func=iprope_policy_group_check line=4345 msg="after check: ret-matched, act-drop, flag-00000800, flag2-00000000"

******

the multicast policy is below (the IPsec tunnel is 'station1-D1' and is up). Also, 'multicast-forward' is enabled as well as

'set multicast-ttl-notchange'

****

config firewall multicast-policy edit 1 set status enable set logtraffic disable set srcintf "port7" set dstintf "station1-D1" set srcaddr "all" set dstaddr "all" set snat enable set snat-ip 0.0.0.0 set dnat 0.0.0.0 set action accept set protocol 0 set auto-asic-offload enable next edit 2 set status enable set logtraffic disable set srcintf "station1-D1" set dstintf "port7" set srcaddr "all" set dstaddr "all" set snat disable set dnat 0.0.0.0 set action accept set protocol 0 set auto-asic-offload enable next end

****

I did an 'iprope list' and the pertinent lines (policy group 0010000a) are:

*****

Policy Group 0010000a

policy index=1 uuid_idx=0 action=accept flag (50104): f_p nat master use_src cos_fwd=0 cos_rev=0 group=0010000a av=00000000 au=00000000 split=00000000 host=0 chk_client_info=0x0 app_list=0 ips_view=0 misc=0 dd_type=0 dd_mode=0 zone(1): 15 -> zone(1): 36 source(1): 0.0.0.0-255.255.255.255, uuid_idx=8, dest(1): 224.0.0.0-239.255.255.255, uuid_idx=0, service(1): [0:0x0:0/(0,65535)->(1,65535)] helper:auto

policy index=2 uuid_idx=0 action=accept flag (10000): master cos_fwd=0 cos_rev=0 group=0010000a av=00000000 au=00000000 split=00000000 host=0 chk_client_info=0x0 app_list=0 ips_view=0 misc=0 dd_type=0 dd_mode=0 zone(1): 36 -> zone(1): 15 source(1): 0.0.0.0-255.255.255.255, uuid_idx=8, dest(1): 224.0.0.0-239.255.255.255, uuid_idx=0, service(1): [0:0x0:0/(0,65535)->(1,65535)] helper:auto

policy index=4294967295 uuid_idx=0 action=drop flag (800): d_rm cos_fwd=0 cos_rev=0 group=0010000a av=00000000 au=00000000 split=00000000 host=0 chk_client_info=0x0 app_list=0 ips_view=0 misc=0 dd_type=0 dd_mode=0 zone(1): 0 -> zone(1): 0 source(1): 0.0.0.0-255.255.255.255, uuid_idx=0, dest(1): 0.0.0.0-255.255.255.255, uuid_idx=0, service(1): [0:0x0:0/(0,0)->(0,0)] helper:auto

*****

I would have thought the first rule (policy index=1) would have matched? but according to the debug flow it doesn't.

Any idea why this doesn't work?

Thanks in advance.