Technical Note: Multicast traffic over site-to-site IPsec VPN without PIM

[smenendez]

Description

This article describes the configuration steps to successfully transmit multicast streaming over an IPsec VPN between two FortiGates without multicast routing.

The following high level diagram illustrates the scenario.

Solution

Set up requirements

- Establish IPsec VPN tunnel between both FortiGates.
- Server side (subnet 10.167.0.0/22) should be able to reach the Client side (subnet  10.144.0.0/22).
- VLC player installed on the server and client side to simulate the stream.
- "multicast-forward" should be enabled in both peers.
- "multicast-router" must be disabled in both peers.
- "multicast firewall policies" should be configured in both peers.
- The multicast traffic received on ingress interface will not be forwarded over the tunnel if the TTL value is too small to go through the FortiGate (default value TTL=1). Therefore, you must enable "multicast-ttl-notchange" or adjust the value in the server.  In this scenario "multicast-ttl-notchange" was enabled in both peers.

Configuration Student - CLI Configuration

***VPN configuration***

config vpn ipsec phase1-interface
edit "tunneltoremote"
        set interface "port1"
        set proposal aes256-sha1
        set dhgrp 5
        set remote-gw 10.108.16.52

config vpn ipsec phase2-interface
    edit "tunneltoremote"
        set phase1name "tunneltoremote"
        set proposal aes256-sha1
        set dhgrp 5
    next
end

***Firewall Policies***

config firewall policy
edit 2
        set uuid 3f41d4ec-1b11-51e5-59e1-89ff338a8b48
        set srcintf "port2"
        set dstintf "tunneltoremote"
        set srcaddr "10.167.0.0/22"
        set dstaddr "10.144.0.0/22"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 3
        set uuid 4ecffd80-1b11-51e5-f9dc-b4973fcba126
        set srcintf "tunneltoremote"
        set dstintf "port2"
        set srcaddr "10.144.0.0/22"
        set dstaddr "10.167.0.0/22"
        set action accept
        set schedule "always"
        set service "ALL"

***Static Route***

config router static
    edit 1
        set gateway 10.108.19.254
        set device "port1"
    next
    edit 2
        set dst 10.144.0.0 255.255.252.0
        set device "tunneltoremote"
    next
end

***Configuration multicast***

config system settings
    set multicast-forward enable
    set multicast-ttl-notchange enable

***Firewall multicast policy***

config firewall multicast-policy
    edit 1
        set srcintf "port2"
        set dstintf "tunneltoremote"
        set srcaddr "all" ----------------> unicast address
        set dstaddr "all" ----------------> multicast address
    next

Remote Configuration - CLI Configuration

***Remote VPN configuration ***

config vpn ipsec phase1-interface
edit "tunneltostudent"
        set interface "port4"
        set proposal aes256-sha1
        set dhgrp 5
        set remote-gw 10.108.16.137

config vpn ipsec phase2-interface
edit "tunneltostudent"
        set phase1name "tunneltostudent"
        set proposal aes256-sha1
        set dhgrp 5
    next
end

****Firewall Policies****

config firewall policy
edit 16
        set uuid d16f4a8a-1b10-51e5-3008-a5f532b77f5c
        set srcintf "tunneltostudent"
        set dstintf "port3"
        set srcaddr "10.167.0.0/22"
        set dstaddr "10.144.0.0/16"
        set action accept
        set schedule "always"
        set service "ALL

edit 17
        set uuid f4186fa8-1b10-51e5-3a14-f0414fd58617
        set srcintf "port3"
        set dstintf "tunneltostudent"
        set srcaddr "10.144.0.0/16"
        set dstaddr "10.167.0.0/22"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

***Static routing***

config router static
 edit 2
        set dst 10.167.0.0 255.255.252.0
        set device "tunneltostudent"
    next

***Multicast configuration***

config system settings
     set multicast-forward enable
    set multicast-ttl-notchange enable

***Multicast policies***

config firewall multicast-policy
    edit 1
        set srcintf "tunneltostudent"
        set dstintf "port3"
        set srcaddr "all" -------------> unicast address
        set dstaddr "all"-----------> multicast address
    next