Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
nanobot
New Contributor

sending multicast over ssl vpn (ssl.root) not working

Hi

 

on a fortigate, have a multicast feed coming in over a GRE tunnel and passing out to an ethernet fine

Also want ssl vpn users to be able to subscribe, have igmp/pim enabled on gre/ethernet/ssl.root, can see the IGMP joins from both the ethernet and ssl.root interfaces (on the fortigate) but PIM never forwards out the ssl.root interface, just the ethernet, only ever shows the ethernet as a forwarding port, why does pim not also forward out the ssl.root interface. 

 

thanks

 

4 REPLIES 4
Anthony_E
Community Manager
Community Manager

Hello nanobot,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Regards,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello,

 

We are still looking for an answer to your question.

We will come back to you as soon as we get it.

 

Regards,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello,

 

I have found this documentation:

 

https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/968606/configuring-multicast...

 

Could you please tell me if it helps?

 

Regards,

Anthony-Fortinet Community Team.
romana
New Contributor

Hi,

To make Multicast stream forwarding over SSL-VPN you should configure IP address on ssl.root interface:

config system interface

edit "ssl.root"

set ip xxx.xxx.xxx.xxx/32

next

end

 

&Note: The IP address should be from the same pool as SSL-VPN clients IP pool (subnet)

&Note#2: Once one of the clients joins some igmp group, all clients will receive that group (channel) multicast traffic, which may be unwanted from security point of view and may cause performance problems on clients side.

$Note#3: All other traffic (unicast stream, ethernet) are working over SSL-VPN even there is not assigned IP address to ssl.root interface.

BR    

 

Top Kudoed Authors