topic Re: Question About Multicast Not Receiving, IP Flood (URGENT ACTION REQUIRED) in General Topics

Question About Multicast Not Receiving, IP Flood (URGENT ACTION REQUIRED)

Sethupathi — Mon, 17 Jun 2019 11:12:08 GMT

Hi Team,

we have done multicast configuration and we are unable to receive multicast through firewall PA-3060. Also whenever we did add our LAN interface into multicast configuration “ other IP flood” critical threat gets started into that particular LAN as shown below. Kindly help me to resolved the same.

Scenario as below,

Requirement as per diagram: PA-3060 WAN interface should receive multicast traffic via ae1.3013 interface and should forward the same to LAN subnet i.e.ae2.3 interface

As per above scenario which interface should I add the RP typeae1.3013 or ae2.3 ..??

We have done following configuration.

Whenever we did configure ae2.3 in multicast configuration other IP flood started in OFT-LAN subnet and dataplane CPU spike up.

Should I increes the SYN alarm rate or disable the SYN in zone protection here? (IS THAT CORRECT?)

NOTE: we have PA-3060 modal with PAN-OS 8.0.16

Could you please provide your valuable suggestion here to fix an issue.

Regards,

Sethupathi M

Re: Question About Multicast Not Receiving, IP Flood (URGENT ACTION REQUIRED)

Sethupathi — Mon, 17 Jun 2019 13:52:29 GMT

Hi Team,

Can anyone provide your valuable suggestion here please.

Regards,

Sethupathi M

Re: Question About Multicast Not Receiving, IP Flood (URGENT ACTION REQUIRED)

Sethupathi — Tue, 18 Jun 2019 11:11:03 GMT

Hi Team,

Can anyone help us here, The DOS Protection profile is configured form WAN Zone to LAN Zone, And Zone protection profile is configured for LAN Zone. Is that a cause its getting an Other IP Flood.

Regards,

Sethupathi M

Re: Question About Multicast Not Receiving, IP Flood (URGENT ACTION REQUIRED)

OtakarKlier — Tue, 18 Jun 2019 14:35:03 GMT

Hello,

Try disabling the Zone protection profile and see if that helps, since its on the internal zone (its usually on the external but internal is not wrong either).

If it helps then its the zone protection profile causing the issue and you just need to make adjustments there.

Regards,

Re: Question About Multicast Not Receiving, IP Flood (URGENT ACTION REQUIRED)

Sethupathi — Thu, 20 Jun 2019 07:11:07 GMT

Hi Otakar,

When we enabled our LAN interface to be part of multicasting other IP flood threats get started and same is drops in zone protection in critical category and which also spike up my data plane CPU by 10 %

Also we removed zone protection from LAN zone and enabled multicast , then our firewall goes on toss i.e. it disturb my CPU as well as other protocol like BGP.

In customer environment they have configured Dos policy from WAN to LAN zone, and also Zone protection profile for LAN zone as well as WAN zone ..?? (Is this a recomended way for using both Dos and Zone protection profile ?)

Regards,

Sethupathi M