Multicast Flooding Issue with 100+ Apple TVs

[chiss]

Hey Guys,

I am the administrator of several schools. At the school in this case, we currently have approximately 1100 mobile devices and around 100+ Apple TVs. In the current setup, there is a VLAN for each class to keep the subnets small (about 30 users per VLAN). Access control is handled through a Microsoft NPS. The Apple TVs also have their own subnets.

The issue arises when we use simple multicast forwarding; the networks get flooded with multicast requests, preventing all devices from discovering all Apple TVs. In the past, we had an Avahi server that manually registered all Apple TVs and listened for multicast packets from the devices. This server could then return the complete list of Apple TVs to the client in 1 or 2 packets.

My question now is: Is there a way to achieve this through the Fortigate, or do you know of other solutions to this problem? Unfortunately, I personally have limited knowledge of multicast.

To anticipate a question: We want to move away from the Avahi solution because it cannot be administered by us, and I hope there is a more elegant solution to this problem, as Avahi requires many scripts and more maintenance.

We are running a FGT201F on 7.0.14 with FortiManager.

[Stephen_G]

Hello chiss,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks

[Stephen_G]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[Markus_M]

Hi chiss,

it will be difficult for me to answer, someone with Apple or more Avahi knowledge will certainly help. I can only make a guess on how Avahi works as being a server that is auto-discovered, requested and hands out the info.

If there is no Avahi server, the autodiscovery will fail and the network is queried. Again, that is my guess.

The "network" here, of course is everything that is reachable, as such it might be good to check on how the layout is done, whether all TVs must be reachable at the same time.

I can guess the FortiGate cannot replace the Avahi function, but it can control multicast with policies (it has multicast policies to allow traffic from one to the other interface).

As you already noted, there is network separation in place already, but it seems to not cover all the devices appropriately since otherwise the storm would not be happening.

Best regards,

Markus