Multicast routing and PIM support
Multicasting (also called IP multicasting) consists of using a single multicast source to send data to many receivers. Multicasting can be used to send data to many receivers simultaneously while conserving bandwidth and reducing network traffic. Multicasting can be used for one-way delivery of media streams to multiple receivers and for one-way data transmission for news feeds, financial information, and so on. Many dynamic routing protocols such as RIPv2, OSPF, and EIGRP use multicasting to share hello packets and routing information.
A FortiGate can operate as a Protocol Independent Multicast (PIM) version 2 router. FortiGates support PIM sparse mode (RFC 4601) and PIM dense mode (RFC 3973), and can service multicast servers or receivers on the network segment to which a FortiGate interface is connected. Groups are supported in the PIM join/prune messages. Multicast routing is not supported in transparent mode.
To support PIM communications, the sending and receiving applications, and all connecting PIM routers in between, must be enabled with PIM version 2. PIM can use static routes, RIP, OSPF, or BGP to forward multicast packets to their destinations. To enable source-to-destination packet delivery, sparse mode or dense mode must be enabled on the PIM router interfaces. Sparse mode routers cannot send multicast messages to dense mode routers. If the FortiGate is located between a source and a PIM router, between two PIM routers, or is connected directly to a receiver, you must manually create a multicast policy to pass encapsulated (multicast) packets or decapsulated data (IP traffic) between the source and destination.
PIM domains
A PIM domain is a logical area comprising a number of contiguous networks. The domain contains at least one bootstrap router (BSR), and if sparse mode is enabled, a number of rendezvous points (RPs) and designated routers (DRs). When PIM is enabled, the FortiGate can perform any of these functions at any time as configured.
A PIM domain can be configured in the GUI by going to Network > Multicast, or in the CLI using config router multicast. Note that PIM version 2 must be enabled on all participating routers between the source and receivers. Use config router multicast to set the global operating parameters.
When PIM is enabled, the FortiGate allocates memory to manage mapping information. The FortiGate communicates with neighboring PIM routers to acquire mapping information and, if required, processes the multicast traffic associated with specific multicast groups.
Instead of sending multiple copies of generated IP traffic to more than one specific IP destination address, PIM-enabled routers encapsulate the data and use a Class D multicast group address (224.0.0.0 to 239.255.255.255) to forward multicast packets to multiple destinations. A single stream of data can be sent because one destination address is used. Client applications receive multicast data by requesting that the traffic destined for a certain multicast group address be delivered to them.
PIM support for virtual routing and forwarding (VRF) NEW
PIM supports all VRFs and is aware of IPv4 multicast routing and forwarding over a single overlay, enhancing network scalability and flexibility compared to the previous VRF 0-only support. See Virtual routing and forwarding for more information.
Per-VRF commands are included for multicast routing, as follows:
config router multicast
config pim-sm-global-vrf
edit <vrf>
set bsr-candidate {enable | disable}
set bsr-interface <interface>
set bsr-priority <0-255, default = 0>
set bsr-hash <0-32, default = 10>
set bsr-allow-quick-refresh {enable | disable}
set cisco-crp-prefix {enable | disable}
config rp-address
edit <id>
set ip-address <RP router IP address>
set group <access list name>
next
end
next
end
end
VRF support is also included in the following diagnose, get, and execute commands:
diagnose ip multicast mfc-add diagnose ip multicast mfc-del diagnose vpn mr|mr6 add diagnose vpn mr|mr6 del get router info multicast igmp groups get router info multicast igmp groups-detail get router info multicast table get router info multicast table-count get router info multicast pim sparse-mode bsr-info get router info multicast pim sparse-mode rp-mapping get router info multicast pim sparse-mode next-hop get router info multicast pim sparse-mode table execute mrouter clear multicast-routes execute mrouter clear sparse-mode-bsr execute mrouter clear sparse-routes execute mrouter clear statistics
Example
This example uses the following topology:
In this example, the multicast server:
-
Sends out multicast traffic 225.1.1.1 from 22.1.1.22 in VRF1.
-
Sends out multicast traffic 225.1.1.2 from 22.1.1.55 in VRF2.
To verify VRF in IPv4 multicast routing:
-
Review the sniffer information:
-
The VRF1 client can receive 225.1.1.1 and cannot receive 225.1.1.2:
24.872130 vd33-vlan33 in 22.1.1.22 -> 225.1.1.1: icmp: echo request 25.872117 vd3-vlan33 out 22.1.1.22 -> 225.1.1.1: icmp: echo request 25.872123 vd33-vlan33 in 22.1.1.22 -> 225.1.1.1: icmp: echo request 26.872131 vd3-vlan33 out 22.1.1.22 -> 225.1.1.1: icmp: echo request 26.872137 vd33-vlan33 in 22.1.1.22 -> 225.1.1.1: icmp: echo request
-
The VRF2 client can receive 225.1.1.2 and cannot receive 225.1.1.1:
4.320988 vd3-vlan331 out 22.1.1.55 -> 225.1.1.2: icmp: echo request 4.320996 vd4-vlan331 in 22.1.1.55 -> 225.1.1.2: icmp: echo request 5.320703 vd3-vlan331 out 22.1.1.55 -> 225.1.1.2: icmp: echo request 5.320717 vd4-vlan331 in 22.1.1.55 -> 225.1.1.2: icmp: echo request 6.320671 vd3-vlan331 out 22.1.1.55 -> 225.1.1.2: icmp: echo request 6.320678 vd4-vlan331 in 22.1.1.55 -> 225.1.1.2: icmp: echo request
-
-
Review the group information:
# get router info multicast igmp groups IGMP Connected Group Membership VRF Group Address Interface Uptime Expires Last Reporter 1 225.1.1.1 vd3-vlan33 00:15:16 stopped(static) 0.0.0.0 2 225.1.1.2 vd3-vlan331 00:14:49 stopped(static) 0.0.0.0