O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

20.6. Use IGMP Proxy Mode to Dynamically Join Groups

Problem

You need to forward multicast traffic to connected hosts, but your upstream router, connected over a virtual private network(VPN), isn't running PIM on its connected interface.

Solution

Use IGMP proxy mode to send IGMP reports to your upstream router. First, configure a Generic Routing Encapsulation (GRE) tunnel. This enables the router to replicate the multicast traffic instead of the firewall:

	FIREWALL-B-> set interface "tunnel.1" zone "Trust"
	FIREWALL-B-> set interface tunnel.1 ip 192.168.11.1/24
	FIREWALL-B-> set interface tunnel.1 tunnel encap gre
	FIREWALL-B->set interface tunnel.1 tunnel local-if loopback.1
	    dst-ip 192.168.6.1

Next, configure an IP Security (IPSec) tunnel, and bind the Security Association (SA) to the GRE interface:

	FIREWALL-B-> set ike gateway "FIREWALL-A" address 192.168.5.2 Main
	    outgoing-interface "bgroup0" preshare
	    "fWKPq2wzNvhiMpsxg0Cr+wBEYpnYfvUoIQ==" sec-level standard
	FIREWALL-B-> set vpn "firewall-a" gateway "FIREWALL-A" no-replay
	    tunnel idletime 0 sec-level standard
	FIREWALL-B-> set vpn "firewall-a" monitor optimized rekey
	FIREWALL-B-> set vpn "firewall-a" id 1 bind interface tunnel.1
	FIREWALL-B-> set route 192.168.7.0/24 interface tunnel.1
	FIREWALL-B->set route 192.168.6.1/32 interface tunnel.1

Configure the firewall in IGMP proxy mode:

	FIREWALL-B-> set interface eth0/0 protocol igmp router
	FIREWALL-B-> set interface eth0/0 protocol igmp enable
	FIREWALL-B-> set interface eth0/0 protocol igmp ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required