10

I've created a lab to troubleshoot an issue I'm having with PIM-SM and BSR. There are two sites connected via two Juniper SSG5s (6.3.0r17) with just enough configuration to focus on the problem at hand (configs below). The sending site has an emulated Cisco 3600 acting as the RP and BSR (config below) and the other site has a receiver.

source --- (fa0/0)R1(fa1/0) --- (bg0)FW1(e0/0) === (e0/0)FW2(bg0) --- receiver

My problem is as follows: FW2 is not learning about the BSR and thus also not learning RP information.

FW1 learns the BSR just fine:

FW1-> get vrouter trust-vr protocol pim bsr
 Zone : Trust
-----------------
 Bootstrap Router address : 10.1.1.1
  BSR hash mask length    : 0
  BSR priority            : 0
  BSR timer expires in    : 00:01:31
  BSR up time             : 00:01:37

Here's FW2:

FW2-> get vrouter trust-vr protocol pim bsr
 Zone : Trust
-----------------
 Bootstrap Router address : 0.0.0.0
  BSR hash mask length    : 0
  BSR priority            : 0
  BSR timer expires in    : -

Specifying a static RP on FW2 with the following two lines gets things going, just to show that PIM is otherwise working:

set vrouter trust-vr access-list 1 permit ip 224.0.0.0/4 1
set vrouter trust-vr protocol pim zone trust rp address 10.1.1.1 mgroup-list 1

Am I misunderstanding something fundamental? debug pim all on FW2 is logging "RP not found for Group" type messages and hellos between the two firewalls, but nothing stands out.

Here are the config commands as entered into fresh devices (I don't see a way to create collapsible sections, sorry for the wall o' text!):

R1:

ip multicast-routing
interface FastEthernet0/0
    ip address 10.1.1.1 255.255.255.0
    ip pim sparse-mode
    no shutdown
interface FastEthernet1/0
    ip address 172.16.1.2 255.255.255.0
    ip pim sparse-mode
    no shutdown
router ospf 1
    network 0.0.0.0 255.255.255.255 area 0.0.0.5
    exit
ip pim bsr-candidate FastEthernet0/0 0
ip pim rp-candidate FastEthernet0/0

FW1:

# interfaces
set interface ethernet0/0 ip 1.1.1.1/24
set interface bgroup0 ip 172.16.1.1/24
set interface bgroup0 route
set interface tunnel.1 zone trust
set interface tunnel.1 ip unnumbered interface bgroup0
# vpn
set ike gateway "GW" address 1.1.1.2 main outgoing-interface ethernet0/0 preshare password sec-level basic
set vpn "VPN" gateway "GW" sec-level basic
set vpn "VPN" monitor optimized rekey
set vpn "VPN" bind interface tunnel.1
set vpn "VPN" proxy-id local-ip 172.16.1.0/24 remote-ip 172.16.2.0/24 any
# ospf
set vrouter trust-vr protocol ospf
set vrouter trust-vr protocol ospf area 0.0.0.5
set vrouter trust-vr protocol ospf enable
set interface bgroup0 protocol ospf area 0.0.0.5
set interface bgroup0 protocol ospf enable
set interface tunnel.1 protocol ospf area 0.0.0.5
set interface tunnel.1 protocol ospf enable
# pim
set vrouter trust-vr protocol pim
set vrouter trust-vr protocol pim enable
set interface bgroup0 protocol pim
set interface bgroup0 protocol pim enable
set interface tunnel.1 protocol pim
set interface tunnel.1 protocol pim enable

FW2:

# interfaces
set interface ethernet0/0 ip 1.1.1.2/24
set interface bgroup0 ip 172.16.2.1/24
set interface bgroup0 route
set interface tunnel.1 zone trust
set interface tunnel.1 ip unnumbered interface bgroup0
# vpn
set ike gateway "GW" address 1.1.1.1 main outgoing-interface ethernet0/0 preshare password sec-level basic
set vpn "VPN" gateway "GW" sec-level basic
set vpn "VPN" monitor optimized rekey
set vpn "VPN" bind interface tunnel.1
set vpn "VPN" proxy-id local-ip 172.16.2.0/24 remote-ip 172.16.1.0/24 any
# ospf
set vrouter trust-vr protocol ospf
set vrouter trust-vr protocol ospf area 0.0.0.5
set vrouter trust-vr protocol ospf enable
set interface bgroup0 protocol ospf area 0.0.0.5
set interface bgroup0 protocol ospf enable
set interface tunnel.1 protocol ospf area 0.0.0.5
set interface tunnel.1 protocol ospf enable
# pim
set vrouter trust-vr protocol pim
set vrouter trust-vr protocol pim enable
set interface bgroup0 protocol pim
set interface bgroup0 protocol pim enable
set interface tunnel.1 protocol pim
set interface tunnel.1 protocol pim enable
# igmp
set interface bgroup0 protocol igmp router
set interface bgroup0 protocol igmp enable

EDIT

Binding the tunnels to the "untrust" zones and adding multicast policies also permits multicast traffic to flow, but I'd still like to keep the tunnels in the "trust" zone.

FW1 & FW2:

set interface tunnel.1 zone untrust
set interface tunnel.1 ip unnumbered interface ethernet0/0
set multicast-group-policy from "trust" mgroup any to "unTrust" pim-message bsr-static-rp join-prune bi-directional
set policy from untrust to trust any any any permit

I've also confirmed that intra-zone blocking is disabled on the "trust" zones, which is the default.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.