topic Multicast questions in General Topics

Multicast questions

Shannon-Rowe — Tue, 07 Feb 2017 20:08:45 GMT

Hi,

I am not famliar with Multicast at all, please forgive my ignorance.

I need to replace Fortigate firewalls with Palo Alto devices and the Fortigates are currently running Multicast. There are no "groups" defined on the fortigate, and if I run "get router info multicast pim sparse-mode table" on the fortigate I can see many groups listed.

Can someone please explain the nature of groups and how they work?

My confusion is that there are no groups explicitly defined on the Fortigate, however, I need to explicitly define groups on the Palo Alto? Do I need to define all groups I see on the Fortigate? Do groups change dynamically or are they static once set (I'm thinking, if I define them on the PAN and they change, will the multicast break)?

Any help and explainations greatly appreciated.

Thanks,

Shannon

Re: Multicast questions

BrianRa — Tue, 07 Feb 2017 20:54:52 GMT

I won't pretend to know the configurations in a Fortigate. However if there are no configurations built for multicast configuration the Fortigate may have a check box for "enable multicast". It may be configured per network / interface or it may be a global option (I would guess less likely global).

You are probably seeing these groups because it is enabled and those devices are broadcasting their request for the multicast groups. Similar with managed switches they keep a table of the devices that have "subscribed" to the multicast groups.

When multicast will become important on the firewall is when you are routing it between networks (you have phones on VLAN 1 and phones on VLAN 2 but both groups hear the page that is sent from any phone, in this case your firewall is the gateway between the VLANs and must know to route that multicast traffic).

I know this isn't a definitive answer to your question but hopefully it will point you in the correct direction.

Brian

PS make sure to post back with the solution you found

Re: Multicast questions

Shannon-Rowe — Tue, 07 Feb 2017 21:07:58 GMT

Hi Brian,

Thanks for that.

Yes the scenario is where video streams from one vlan need to be routed to another vlan (receivers).

I guess I am confused as to how to identify what groups the PAN needs to be a member of to make this work.

Cheers,

Shannon

Re: Multicast questions

BrianRa — Tue, 07 Feb 2017 21:15:19 GMT

Shannon,

It looks like there are a couple of ways to configure multicast in PAN OS, doing a google search for "pan firewall multicast" brings up a multiple options. Unfortunately I haven't played with it at all on PAN firewalls so I don't have any specific advice on it. A support case might be helpful for some relevant documentation to your situation as well as other peoples experience here.

It may also help to describe what you are doing so people can point you in the right direction.

Brian