topic Re: mDNS (Apple Bounjour) between two VLANs through a PA in General Topics

mDNS (Apple Bounjour) between two VLANs through a PA

myrdin — Wed, 14 Sep 2016 05:41:04 GMT

Hi,

this is the scenario:

- a PA with two physical L3 interfaces (1 zone per interface, 1 subnet per interface, we call them A and B).

- I have a device in Subnet A which is an Airport thing with a printer attached. Devices in Subnet A they can discover the printer via the Apple Bonjour service

- Devices in Subnet B cannot discover the printer in subnet A

- Traffic from/to these two subnets is completely allowed, no restrictions whatsover, and no NAT.

- Both subnets and devices have the PA interface as default gateway

- i am running 7.1

What i did:

- in network-router, i edited the existing virtual router, went to "Multicast" and enabled Multicast. -

- RP Static, RP Interface is the Subnet A interface, RP Address the Subnet A interface address

- Group list: 224.0.0.0/4

- Remote Rendevous point: empty

Interfaces: Subnet A interface, Subnet B Interface IGMP/PIM enabled

- added policy from Subnet A zone and Subnet B zone to "Multicast" zone all allowed

- and committed

Still from Subnet B i cannot see the airport via the multicast Bonjour service. Ideas?

thanks heaps

Re: mDNS (Apple Bounjour) between two VLANs through a PA

RFalconer — Thu, 15 Sep 2016 16:27:30 GMT

By default, Bounjour only works in a single broadcast domain so it won't traverse the firewall.

To get Bonjour to work across subnets, you need to use wide area Bonjour by creating specific DNS entries.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

myrdin — Tue, 20 Sep 2016 09:29:13 GMT

thanks RFalconer.

after a lot more reading, i found out that Bonjour sets ttl=1 by default so crossing a router, although possible, will decrease ttl to 0 and the packet it is discarded. This is by design.

Multicast routing although possible, it will not serve this purpose hence it won't work.

The only way to handle this is to use a bonjour gateway which is a feature some vendors offer, like Aruba or Cisco Meraki.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

REganEVO — Sat, 25 May 2019 01:05:48 GMT

How can this be accomplished? Can you forward local mDNS queries (224.0.0.251) to something routable (224.0.1.251)? Is that what you're suggesting to cross zones?

Re: mDNS (Apple Bounjour) between two VLANs through a PA

jdanjuma — Thu, 27 Aug 2020 19:55:35 GMT

If you are reading this in 2020, support for Bonjour has been added to PAN-OS version 10.0.1.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

Ricky_Wang — Wed, 02 Sep 2020 05:34:58 GMT

When will PAN-OS 10.0.1 be released?

Re: mDNS (Apple Bounjour) between two VLANs through a PA

jdanjuma — Wed, 02 Sep 2020 18:24:20 GMT

Mid-September is the estimated target.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

Ricky_Wang — Fri, 04 Sep 2020 03:53:39 GMT

10.0.1 just landed, however this feature is only supported on PA-220, PA-800 and PA-3200... It is not supported on PA-VM.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

fb-pan — Sun, 13 Sep 2020 09:46:24 GMT

I did some testing on a PA 220. It works well so far.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

JerzyKolysz — Mon, 14 Sep 2020 13:59:49 GMT

Can You give some instructions please ? Is there any official paper ?

Re: mDNS (Apple Bounjour) between two VLANs through a PA

fb-pan — Mon, 14 Sep 2020 14:06:15 GMT

Documentation is here (afaik):

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/configure-interfaces/bonjour-reflector-for-network-segmentation.html

If you have an internal interface and a IoT Interface, you just need the bonjour reflector on both interfaces. it's possible up to 16if.

It works on ae and subinterfaces.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

JerzyKolysz — Mon, 14 Sep 2020 14:08:47 GMT

Thanks !, I miss that I hope it will work for HomeKit as well.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

JerzyKolysz — Tue, 15 Sep 2020 10:41:25 GMT

It does not work for me or I am doing something wrong,

name rx tx drop
----------------------------------------------------------
ethernet1/3.10 39 122 0
ethernet1/3.20 122 39 0

I looks like PA-220 reflecting Bonjur Packets - I made rule from LAN to IOT but there is no traffic,

I installed Bonjur Discovery app on Mac and I can See all devices but Mac home app or screen mirroring are not available,

should I do anything more then enable reflector and creating a rule ?

Maybe some DNS proxy trick, my dns is set up to some Internet Gateway right now.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

JerzyKolysz — Tue, 15 Sep 2020 16:22:17 GMT

Still no success,

I tried to compare mDns browser app from IOT vlan and user Lan and both are the same.

I spot that rule is not required because Pa-220 will forward 100% necessary traffic.

I am going to create support case for that I know that this is new thing for PA, still they need user feedback, and I need this functionality.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

AlexNC — Fri, 08 Jan 2021 10:57:00 GMT

Hi There

Did the case reveal anything new? I enabled it on the two interfaces in question but have the same result.

Thank you and best regards

Re: mDNS (Apple Bounjour) between two VLANs through a PA

JerzyKolysz — Fri, 08 Jan 2021 11:09:50 GMT

Yes,

You have to add valid access list, and remember to do it in both ways because many of this traffic is generated from both sides.

Put application any and port any if You can for a start and then add discovered apps - it depends on what devices You have.

If Home kit is purpose of Your setup You can leave only app center like Apple TV on lan side in accls.

Regards,

Jerzy Kołysz

Re: mDNS (Apple Bounjour) between two VLANs through a PA

AlexNC — Fri, 08 Jan 2021 11:15:34 GMT

I've allowed CLIENTS to APPLETV and APPLETV to CLIENTS Security Zone for ANY / ANY
but still no luck, what about the DNS setting that you've mentioned?

Thanks

Alex

Re: mDNS (Apple Bounjour) between two VLANs through a PA

JerzyKolysz — Fri, 08 Jan 2021 11:28:07 GMT

Lets speak abut this scenario https://lucid.app/lucidchart/invitations/accept/6024dbd9-e4e4-4a9c-bb96-f95bec16352a

I suggest put IOT devices to IOT network and Apple TV to general network ( LAN )

then turn on Bonjur reflector, after that make ACL from lan zone to iot zone, and one more in opposite directions.

if You will make two ACL instead of one You can add in destination Lan Your Apple TV. and in src Lan in second ACL.

I have setup like that and it works.

I suggest to put Apple tv to LAN because it usually needs Internet connection.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

apazmino — Thu, 25 Aug 2022 13:55:25 GMT

Hi. I also need some instructions, because communications between subnets is not possible, however bonjour reflector is enable in interface.. I use only one lan interface (bonjour active). Thks colleages.

Re: mDNS (Apple Bounjour) between two VLANs through a PA

JerzyKolysz — Thu, 25 Aug 2022 15:57:52 GMT

You need to enable reflector on both IOT and lan interface, and create appropriate security rules.