I have an IPSec site-to-site VPN setup between two SRX300 devices. I am trying to get multicast to travel across. I am looking for the simplest configuration possible to get this setup. I have found many articles, but most are far more complicated use cases than I have. I do not have NAT (at least not yet). I was hoping to just enable IGMP and everything would work, but it doesn't seem to be that easy.
multicast-source---LAN---SRX@remote1 SRX@hub1---LAN---multicast-receiver
192.168.1.100/24 192.168.1.1/24 192.168.2.1/24 192.168.2.100/24
10.50.1.1/8--WAN--10.50.1.2/8
(Ignore the fact that I'm using a private 10 network on the WAN right now)
SRX Configuration on the hub
security {
ike {
policy ike-phase1-policy {
mode aggressive;
proposal-set compatible;
pre-shared-key ascii-text "$9$VVs4J5TF39t";
}
gateway gw-remote1 {
ike-policy ike-phase1-policy;
address 10.50.1.1;
external-interface ge-0/0/5.0;
}
}
ipsec {
policy ipsec-phase2-policy {
proposal-set compatible;
}
vpn ike-vpn-remote1 {
bind-interface st0.0;
ike {
gateway gw-remote1;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
}
...
zones {
security-zone trust {
address-book {
address hub1 192.168.2.0/24;
}
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
}
}
security-zone untrust {
address-book {
address remote1 192.168.1.0/24;
}
host-inbound-traffic {
system-services {
ike;
}
protocols {
pim;
}
}
interfaces {
ge-0/0/5.0 {
host-inbound-traffic {
system-services {
ping;
}
}
}
st0.0 {
host-inbound-traffic {
protocols {
pim;
}
}
}
}
}
}
}
interfaces {
ge-0/0/1 {
unit 0 {
family inet {
address 192.168.2.1/24;
}
}
}
ge-0/0/5 {
unit 0 {
family inet {
address 10.50.1.2/24;
}
}
}
lo0 {
unit 0 {
family inet {
address 10.255.0.156/32;
}
}
}
st0 {
unit 0 {
family inet;
}
}
}
routing-options {
traceoptions {
file all-packets-trace;
flag all;
}
static {
route 192.168.1.0/24 next-hop st0.0;
route 0.0.0.0/0 next-hop 10.50.1.1;
}
}
protocols {
ospf {
area 0.0.0.0 {
interface st0.0;
interface ge-0/0/5.0 {
passive;
}
interface lo0.0;
}
}
pim {
rp {
local {
address 10.255.0.156;
}
}
interface st0.0;
interface ge-0/0/5.0;
interface lo0.0 {
family inet;
}
}
}
```
SRX Configuration on remote1 (basically a mirror of above):
```
security {
ike {
policy ike-phase1-policy {
mode aggressive;
proposal-set compatible;
pre-shared-key ascii-text "$9$m5F6Ehyrv8";
}
gateway gw-hub1 {
ike-policy ike-phase1-policy;
address 10.50.1.2;
external-interface ge-0/0/5.0;
}
}
ipsec {
policy ipsec-phase2-policy {
proposal-set compatible;
}
vpn vpn-hub1 {
bind-interface st0.0;
ike {
gateway gw-hub1;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
}
...
zones {
security-zone trust {
address-book {
address remote1 192.168.1.0/24;
}
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
}
}
security-zone untrust {
address-book {
address hub1 192.168.2.0/24;
}
host-inbound-traffic {
system-services {
ike;
}
protocols {
pim;
}
}
interfaces {
ge-0/0/5.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
st0.0 {
host-inbound-traffic {
protocols {
pim;
}
}
}
}
}
}
}
interfaces {
ge-0/0/1 {
unit 0 {
family inet {
address 192.168.1.1/24;
}
}
}
ge-0/0/5 {
unit 0 {
family inet {
address 10.50.1.1/24;
}
}
}
st0 {
unit 0 {
family inet;
}
}
}
routing-options {
traceoptions {
file all-packets-trace;
flag all;
}
static {
route 192.168.2.0/24 next-hop st0.0;
route 0.0.0.0/0 next-hop 10.50.1.2;
}
}
protocols {
ospf {
area 0.0.0.0 {
interface st0.0;
interface ge-0/0/1.0 {
passive;
}
interface lo0.0;
}
}
pim {
rp {
static {
address 10.255.0.156;
}
}
interface ge-0/0/5.0;
interface lo0.0;
interface st0.0;
}
}
