O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

20.2. Use Multicast Group Policies to Enforce Stateful Multicast Forwarding

Problem

You're running a firewall in Layer 3 mode, and you need to create a policy to statefully enforce multicast traffic.

Solution

Use a multicast group policy to allow multicast control messages between zones:

	FIREWALL-A-> set vrouter trust-vr
	FIREWALL-A(trust-vr)-> set access-list 10 permit ip 239.1.2.3/32 10
	FIREWALL-A(trust-vr)-> exit
	FIREWALL-A->set multicast-group-policy from trust mgroup-list 10 to
	    untrust igmp-message bi-directional

Discussion

Setting up a multicast group policy to allow the firewall to create multicast state is required for support of multicast traffic in route mode. Two types of policies can be configured: one for IGMP proxy mode, and one for PIM depending on the device's operating mode. Multicast group policies are a frequent source of confusion when you are first configuring ScreenOS to forward multicast traffic, but conceptually, they are fairly simple. Unlike traditional firewall policies that are used to permit or deny traffic, multicast group policies are used to add a stateful enforcement capability to multicast. Because multicast traffic flows are unidirectional, to enforce a component of state ScreenOS looks at the state of the flow, much as a router would. Multicast forwarding has a control component similar to other higher-layer protocols. The primary difference is that multicast state exists purely at Layer 3. In PIM, a router forms state when a downstream device is interested ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required