3

I have an IPSec site-to-site VPN setup between two SRX300 devices. I am trying to get multicast to travel across. I am looking for the simplest configuration possible to get this setup. I have found many articles, but most are far more complicated use cases than I have. I do not have NAT (at least not yet). I was hoping to just enable IGMP and everything would work, but it doesn't seem to be that easy.

multicast-source---LAN---SRX@remote1          SRX@hub1---LAN---multicast-receiver
192.168.1.100/24      192.168.1.1/24        192.168.2.1/24    192.168.2.100/24
                           10.50.1.1/8--WAN--10.50.1.2/8

(Ignore the fact that I'm using a private 10 network on the WAN right now)

SRX Configuration on the hub

security {
    ike {
        policy ike-phase1-policy {
            mode aggressive;
            proposal-set compatible;
            pre-shared-key ascii-text "$9$VVs4J5TF39t";
        }
        gateway gw-remote1 {
            ike-policy ike-phase1-policy;
            address 10.50.1.1;
            external-interface ge-0/0/5.0;
        }
    }
    ipsec {
        policy ipsec-phase2-policy {
            proposal-set compatible;
        }
        vpn ike-vpn-remote1 {
            bind-interface st0.0;
            ike {
                gateway gw-remote1;
                ipsec-policy ipsec-phase2-policy;
            }
            establish-tunnels immediately;
        }
    }
...
    zones {
        security-zone trust {
            address-book {
                address hub1 192.168.2.0/24;
            }
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                ge-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
            }
        }
        security-zone untrust {
            address-book {
                address remote1 192.168.1.0/24;
            }
            host-inbound-traffic {
                system-services {
                    ike;
                }
                protocols {
                    pim;
                }
            }
            interfaces {
                ge-0/0/5.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                        }
                    }
                }
                st0.0 {
                    host-inbound-traffic {
                        protocols {
                            pim;
                        }
                    }
                }
            }
        }
    }
}
interfaces {
    ge-0/0/1 {
        unit 0 {
            family inet {
                address 192.168.2.1/24;
            }
        }
    }
    ge-0/0/5 {
        unit 0 {
            family inet {
                address 10.50.1.2/24;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 10.255.0.156/32;
            }
        }
    }
    st0 {
        unit 0 {
            family inet;
        }
    }
}
routing-options {
    traceoptions {
        file all-packets-trace;
        flag all;
    }
    static {
        route 192.168.1.0/24 next-hop st0.0;
        route 0.0.0.0/0 next-hop 10.50.1.1;
    }
}
protocols {
    ospf {
        area 0.0.0.0 {
            interface st0.0;
            interface ge-0/0/5.0 {
                passive;
            }
            interface lo0.0;
        }
    }
    pim {
        rp {
            local {
                address 10.255.0.156;
            }
        }
        interface st0.0;
        interface ge-0/0/5.0;
        interface lo0.0 {
            family inet;
        }
    }
}
```

SRX Configuration on remote1 (basically a mirror of above):
```
security {
    ike {
        policy ike-phase1-policy {
            mode aggressive;
            proposal-set compatible;
            pre-shared-key ascii-text "$9$m5F6Ehyrv8";
        }
        gateway gw-hub1 {
            ike-policy ike-phase1-policy;
            address 10.50.1.2;
            external-interface ge-0/0/5.0;
        }
    }
    ipsec {
        policy ipsec-phase2-policy {
            proposal-set compatible;
        }
        vpn vpn-hub1 {
            bind-interface st0.0;
            ike {
                gateway gw-hub1;
                ipsec-policy ipsec-phase2-policy;
            }
            establish-tunnels immediately;
        }
    }
...
    zones {
        security-zone trust {
            address-book {
                address remote1 192.168.1.0/24;
            }
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                ge-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
            }
        }
        security-zone untrust {
            address-book {
                address hub1 192.168.2.0/24;
            }
            host-inbound-traffic {
                system-services {
                    ike;
                }
                protocols {
                    pim;
                }
            }
            interfaces {
                ge-0/0/5.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
                st0.0 {
                    host-inbound-traffic {
                        protocols {
                            pim;
                        }
                    }
                }
            }
        }
    }
}
interfaces {
    ge-0/0/1 {
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
    ge-0/0/5 {
        unit 0 {
            family inet {
                address 10.50.1.1/24;
            }
        }
    }
    st0 {
        unit 0 {
            family inet;
        }
    }
}
routing-options {
    traceoptions {
        file all-packets-trace;
        flag all;
    }
    static {
        route 192.168.2.0/24 next-hop st0.0;
        route 0.0.0.0/0 next-hop 10.50.1.2;
    }
}
protocols {
    ospf {
        area 0.0.0.0 {
            interface st0.0;
            interface ge-0/0/1.0 {
                passive;
            }
            interface lo0.0;
        }
    }
    pim {
        rp {
            static {
                address 10.255.0.156;
            }
        }
        interface ge-0/0/5.0;
        interface lo0.0;
        interface st0.0;
    }
}
1

As far as i know you cannot run multicast over IPSec. What you need to do is have GRE over IPSec and then put multicast through the GRE.

So essentially you are encapsulating the multicast traffic in GRE tunnels, which are then encapsulated by IPSec.

6
  • Thanks -- GRE looks to be another approach (besides PIM). I've given it a shot, based on kb.juniper.net/InfoCenter/index?page=content&id=KB19372 but still no luck. I suspect I have something wrong in the zones or security policy setup...or perhaps I need some IGMP setup as well, that is not mentioned in that KB article.
    – Ben
    May 19 '17 at 16:02
  • GRE is not another aproach to PIM. you run GRE, then run a routing protocol like OSPF on top of it, and then you get PIM and IGMP running. We have a similar setup for one of our remote sites. Also make sure you adjust MTU values down to 1400, as you're adding GRE, and IPSec headers to the original traffic. May 24 '17 at 15:22
  • Thanks, Stanley -- my misunderstanding. I'm still having trouble getting it working. Do you have to use OSPF, or can you use static routing instead? I have the IPSec tunnel and the GRE tunnel setup and I can ping across them. I also have protocols igmp and pim setup. No dice still...i'm sure I'm missing something. Any idea if I need to configure the "routing-options multicast" as well?
    – Ben
    May 24 '17 at 16:21
  • you do not need to use OSPF. PIM = Protocol "Independent" Multicast, so it was designed to be able to run on any underlying unicast routing protocol. You can use OSPF, BGP and even static routing if you want. So you are on the right path, if you can ping all the end points, the next step is to troubleshoot why multicast is not working. Can you check show igmp groups, and show pim neighbours to start. Also, what kind of PIM are you using ? did you setup an RP ? I apologize for the lack of Juniper knowledge, but multicast should work the same way. May 25 '17 at 14:58
  • I really appreciate the help. I am using PIM Sparse mode, and have a static RP (the lo interface of the hub/mcast receiver end SRX). I'm not exactly sure what to look for, but do see the igmp group on the SRX at the receiver end, so my application is sending the join message. What do I look for in show pim neighbors? Sometimes I worry I have PIM enabled on too many interfaces, so I trimmed it down to just the GRE tunnel interface (gr-0/0/0.0) and the external LAN interface. When I had PIM enabled on all interfaces, it also didn't work, so not sure how it should be configured. Same with IGMP.
    – Ben
    May 26 '17 at 13:30
1

I believe my issue was in specifying the PIM RP (Rendezvous Point). On the SRX with the RP itself, must use: set pim rp local address ... but on the remote use: set pim rp static address ...

That seemed to fix everything.

1
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    May 30 '17 at 19:22
0

Multicast routing is very different from unicast routing. Multicast, like broadcast, is normally limited to a single LAN, and that is where IGMP works. You are trying to multicast to a different network, and that requires multicast routing, e.g. PIM, to be enabled and configured. Also, your VPN tunnel must allow broadcast (multicast), and not all do.

Cisco has a diagram about the different multicast protocols:

enter image description here

IGMP is a protocol between the host and the multicast router. PIM works between routers to route multicast packets.

1
  • Thanks - that explanation helps a lot. I configured PIM, but still not working. I'm not exactly sure what else to try, or what is wrong with my configuration. I'll update the original question with some configuration snippets.
    – Ben
    May 17 '17 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.