FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
nvisentin_FTNT
Article Id 190708
Description
This article talks about use of a PIM Designated Router (PIM DR) to avoid duplicated multicast stream in a dual homed network.

Solution
In the following diagram, A is the receiver and B is the source sending multicast traffic to 239.1.1.1.  The Rendezvous Point (RP) is R3.

Client (A) network is dual homed, R1 and R2 are configured with VRRP, R1 is the master router.  OSPF is already configured with default cost, resulting in the following paths (asymroute is enabled as well):
  • A -> B : R1 -> R3 -> R4
  • B -> A : R4 -> R2
R1 port2 and R2 port3 are configured in OSPF and PIM passive to prevent OSPF and PIM neighboring.
nvisentin_FD39351_tn_FD39351-1.jpg

The relevant parts of the configuration of R1 and R2 are:

R1
config router ospf
    set router-id 1.1.1.1
        config area
            edit 0.0.0.0
            next
        end
        config network
            edit 1
                set prefix 1.1.1.1 255.255.255.255
            next
            edit 2
                set prefix 10.0.0.1 255.255.255.255
            next
            edit 3
                set prefix 10.1.3.1 255.255.255.255
            next
        end
    set passive-interface "port2"
        config redistribute "connected"
        end
        config redistribute "static"
        end
        config redistribute "rip"
        end
        config redistribute "bgp"
        end
        config redistribute "isis"
        end
end

config router multicast
    set multicast-routing enable
        config pim-sm-global
                config rp-address
                    edit 1
                        set ip-address 3.3.3.3
                    next
                end
        end
        config interface
            edit "port2"
                set pim-mode sparse-mode
                set passive enable
                    config igmp
                        set access-group "MCAST_239.1.1.1"
                    end
            next
            edit "r1_r3_0"
                set pim-mode sparse-mode
                    config igmp
                        set access-group "DENY_ALL"
                    end
            next
        end
end

R2
config router ospf
    set router-id 2.2.2.2
        config area
            edit 0.0.0.0
            next
        end
        config network
            edit 1
                set prefix 2.2.2.2 255.255.255.255
            next
            edit 2
                set prefix 10.0.0.2 255.255.255.255
            next
            edit 3
                set prefix 10.2.4.2 255.255.255.255
            next
        end
    set passive-interface "port3"
        config redistribute "connected"
        end
        config redistribute "static"
        end
        config redistribute "rip"
        end
        config redistribute "bgp"
        end
        config redistribute "isis"
        end
end

config router multicast
    set multicast-routing enable
        config pim-sm-global
                config rp-address
                    edit 1
                        set ip-address 3.3.3.3
                    next
                end
        end
        config interface
            edit "port3"
                set pim-mode sparse-mode
                set passive enable
                    config igmp
                        set access-group "MCAST_239.1.1.1"
                    end
            next
            edit "r2_r4_0"
                set pim-mode sparse-mode
                    config igmp
                        set access-group "DENY_ALL"
                    end
            next
        end
end

Looking at a packet capture on the client A, it can be seen that the multicast packets for the same multicast stream are received twice:

1. from R1 MAC (52:54:00:16:bf:27)
2. from R2 MAC (52:54:00:8f:89:b4)

nvisentin_FD39351_tn_FD39351-2.jpg

The issue is as follows:

R1 and R2 receive an IGMP group membership report for 239.1.1.1 from client A.  Both R1 and R2 send a PIM join toward the RP, then 2 forwarding trees are created from the source toward the client A. 

Both R1 and R2 have a S,G entry in the multicast routing table:

R1 # get router info multicast pim sparse-mode table 239.1.1.1
IP Multicast Routing Table

(*,*,RP) Entries: 0
(*,G) Entries: 1
(S,G) Entries: 6
(S,G,rpt) Entries: 6
FCR Entries: 0

(*, 239.1.1.1)
RP: 3.3.3.3
RPF nbr: 10.1.3.3
RPF idx: r1_r3_0
Upstream State: JOINED
 Local:
     port2
 Joined:
 Asserted:
     port2: winner
FCR:

(10.4.0.10, 239.1.1.1)
RPF nbr: 10.1.3.3
RPF idx: r1_r3_0
SPT bit: 1
Upstream State: JOINED
 Local:
 Joined:
 Asserted:
 Outgoing:
     port2

(10.4.0.10, 239.1.1.1, rpt)
RP: 3.3.3.3
RPF nbr: 10.1.3.3
RPF idx: r1_r3_0
Upstream State: NOT PRUNED
 Local:
 Pruned:
 Outgoing:

R2 # get router info multicast pim sparse-mode table 239.1.1.1
IP Multicast Routing Table

(*,*,RP) Entries: 0
(*,G) Entries: 1
(S,G) Entries: 4
(S,G,rpt) Entries: 4
FCR Entries: 0

(*, 239.1.1.1)
RP: 3.3.3.3
RPF nbr: 10.2.4.4
RPF idx: r2_r4_0
Upstream State: JOINED
 Local:
     port3
 Joined:
 Asserted:
FCR:

(10.4.0.10, 239.1.1.1)
RPF nbr: 10.2.4.4
RPF idx: r2_r4_0
SPT bit: 1
Upstream State: JOINED
 Local:
 Joined:
 Asserted:
 Outgoing:
     port3

(10.4.0.10, 239.1.1.1, rpt)
RP: 3.3.3.3
RPF nbr: 10.2.4.4
RPF idx: r2_r4_0
Upstream State: NOT PRUNED
 Local:
 Pruned:
 Outgoing:

To address this issue, it is mandatory to enable PIM neighboring between R1 and R2 over their LAN interface (port2 and port3).

Once the PIM neighbor relationship is established, a PIM Designated Router (DR) will be elected.  On a broadcast network, the PIM DR is used to send the PIM join toward the RP.

R1
config router multicast
        config interface
            edit "port2"
            unset passive
            next
        end
end

R2
config router multicast
        config interface
            edit "port3"
            unset passive
            next
        end
end

By default, the router with the highest IP wins the DR election, meaning that R2 will be the DR.  Thus it will receive and forward the multicast stream (S,G is present in the multicast routing table):
R2 # get router info multicast pim sparse-mode neighbour
Neighbor          Interface          Uptime/Expires    Ver   DR
Address                                                      Priority/Mode
10.0.0.1          port3              00:11:05/00:01:40 v2    1 /
10.2.4.4          r2_r4_0            05:56:04/00:01:41 v2    1 / DR

R2 # get router info multicast pim sparse-mode table 239.1.1.1
IP Multicast Routing Table

(*,*,RP) Entries: 0
(*,G) Entries: 1
(S,G) Entries: 4
(S,G,rpt) Entries: 4
FCR Entries: 0

(*, 239.1.1.1)
RP: 3.3.3.3
RPF nbr: 10.2.4.4
RPF idx: r2_r4_0
Upstream State: JOINED
 Local:
     port3
 Joined:
 Asserted:
FCR:

(10.4.0.10, 239.1.1.1)
RPF nbr: 10.2.4.4
RPF idx: r2_r4_0
SPT bit: 1
Upstream State: JOINED
 Local:
 Joined:
 Asserted:
 Outgoing:
     port3

(10.4.0.10, 239.1.1.1, rpt)
RP: 3.3.3.3
RPF nbr: 10.2.4.4
RPF idx: r2_r4_0
Upstream State: NOT PRUNED
 Local:
 Pruned:
 Outgoing:

R1 no longer receives the multicast stream (no S,G entry):
R1 # get router info multicast pim sparse-mode neighbour
     Neighbor          Interface          Uptime/Expires    Ver   DR
Address                                                      Priority/Mode
10.0.0.2          port2              00:12:52/00:01:29 v2    1 / DR
10.1.3.3          r1_r3_0            05:57:51/00:01:26 v2    1 / DR

R1 # get router info multicast pim sparse-mode table 239.1.1.1
IP Multicast Routing Table

(*,*,RP) Entries: 0
(*,G) Entries: 1
(S,G) Entries: 4
(S,G,rpt) Entries: 4
FCR Entries: 0

(*, 239.1.1.1)
RP: 0.0.0.0
RPF nbr: 0.0.0.0
RPF idx: None
Upstream State: NOT JOINED
 Local:
     port2
 Joined:
 Asserted:
FCR:

A packet capture on client A confirms that the multicast packets are received from R2 only:
nvisentin_FD39351_tn_FD39351-3.jpg
The multicast stream is being received from R2, but it is possible to received it from R1.  Simply configure R1 as the DR using a higher priority (by default priority = 1):
conf router multicast
        config interface
            edit "port2"
                set dr-priority 100
            next
        end
end

The multicast packets are now received from R1:
nvisentin_FD39351_tn_FD39351-4.jpg 

Contributors