sending multicast over ssl vpn (ssl.root) not working

[nanobot]

Hi

on a fortigate, have a multicast feed coming in over a GRE tunnel and passing out to an ethernet fine

Also want ssl vpn users to be able to subscribe, have igmp/pim enabled on gre/ethernet/ssl.root, can see the IGMP joins from both the ethernet and ssl.root interfaces (on the fortigate) but PIM never forwards out the ssl.root interface, just the ethernet, only ever shows the ethernet as a forwarding port, why does pim not also forward out the ssl.root interface. 

thanks

[Anthony_E]

Hello nanobot,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[Anthony_E]

Hello,

We are still looking for an answer to your question.

We will come back to you as soon as we get it.

Regards,

[Anthony_E]

Hello,

I have found this documentation:

https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/968606/configuring-multicast...

Could you please tell me if it helps?

Regards,

[romana]

Hi,

To make Multicast stream forwarding over SSL-VPN you should configure IP address on ssl.root interface:

config system interface

edit "ssl.root"

set ip xxx.xxx.xxx.xxx/32

next

end

&Note: The IP address should be from the same pool as SSL-VPN clients IP pool (subnet)

&Note#2: Once one of the clients joins some igmp group, all clients will receive that group (channel) multicast traffic, which may be unwanted from security point of view and may cause performance problems on clients side.

$Note#3: All other traffic (unicast stream, ethernet) are working over SSL-VPN even there is not assigned IP address to ssl.root interface.

BR