2


I am connected to the Internet through an Cisco ME3400EG-2CS-A access switch, routing enabled.
Gi0/1 and Gi0/2 are configured as a SVI (VLAN1) and on that ports I attached two pfSense firewalls with a configured CARP WAN.

My problem is that CARP doesn't work as expected for some multicast filtering reason.
It has somehow to deal with that ME3400EG, because if I install a simple L2 Switch between ME3400EG (on just GI0/1) and both firewalls, CARP is stable.

I built up an test environment with an SG300 switch (instead of the ME3400EG) and I could recreate this issue if I set on Gi0/2 "bridge multicast unregistred filtering".

My ISP doesn't want to help me because the multicast packets from the firewall have a MAC starting with 00:00:5E:00:01:01 and they say that multicast packets only can be forwarded if the look like this: 01:00:5E:00:01:01

Can I forward unregistred multicasts on the ME3400EG?

UPDATE: Now I bought a ME3400EG for testing purpose.
Here is the config like on ISPs: 

Current configuration : 1041 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
no logging console
!
no aaa new-model
system mtu routing 1546
ip routing
no ip domain-lookup
!
!
!
!         
!
!
!
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
!
vlan internal allocation policy ascending
!
!
!
interface FastEthernet0
 no ip address
 no ip route-cache cef
 no ip route-cache
!
interface GigabitEthernet0/1
 load-interval 30
 media-type rj45
!
interface GigabitEthernet0/2
 load-interval 30
 media-type rj45
!
interface GigabitEthernet0/3
 port-type nni
!
interface GigabitEthernet0/4
 port-type nni
 no switchport
 ip address 95.198.122.14 255.255.255.252
!
interface Vlan1
 ip address 82.142.123.17 255.255.255.248
!
interface Vlan10
 no ip address
!
no ip http server
ip http secure-server
ip classless
!
!
ip sla enable reaction-alerts
no cdp run
no cdp tlv location
no cdp tlv app
!
!
line con 0
line vty 5 15
!
end

I already tried no switchport block multicast but it seems to be default like this.

UPDATE2:

If I issue show ip igmp interface vlan 1 I get: 

Vlan1 is up, line protocol is up
  Internet address is 82.142.123.17/29
  IGMP is disabled on interface
  Multicast routing is disabled on interface
  Multicast TTL threshold is 0
  No multicast groups joined by this system

Should multicast not be enabled? Or TTL at least 1? Or the hosts as joined in a multicast group??

Improve this question
6
  • Are you trying to use the Cisco ME3400EG switch as a layer-3 switch (trying to route between networks)?
    – Ron Maupin ♦
    Commented Jun 12, 2018 at 17:48
  • yes, its configured by the ISP as router
    – fips123
    Commented Jun 12, 2018 at 18:01
  • You cannot forward link-local multicast to another network. You can route other multicast, using multicast routing, which is very different than unicast routing, and it must be explicitly configured. In any case, FHRPs (First Hop Redundancy Protocols) like HSRP, VRRP, CARP, etc. are only valid on the network they serve. I think you are trying to do something you cannot do. Since the FH in FHRP stands for First Hop, it makes no sense to try to use it more hops away from a host.
    – Ron Maupin ♦
    Commented Jun 12, 2018 at 18:14
  • sorry, maybe I wrote it stupid, but both firewalls and both ports of ME3400Eg are within the same broadcast domain.
    – fips123
    Commented Jun 12, 2018 at 20:17
  • OK, then you need to post a diagram and your configurations. It seems you do not really have everything in the same layer-3 network and layer-2 broadcast domain. If it works on a layer-2 switch, then you obviously have misconfigured something on the Cisco switch.
    – Ron Maupin ♦
    Commented Jun 12, 2018 at 20:54

2 Answers 2

Reset to default
1

The 00:00:5E:00:01:01 MAC address is not a multicast MAC address, and it is not even a group MAC address because it doesn't have the I/G bit set. That may be a source MAC address.

The 01:00:5E:00:01:01 MAC address is an IPv4 multicast MAC address. Notice that the I/G bit is set indicating that it is a group address. That address would be a destination MAC address.

It appears that your CARP implementation is flawed. There are multiple questions and answer here about the problem. For example, KEMP load balancers using UCARP (VRRP) - multicast MAC address not being picked up

Improve this answer
3
  • But according to RFC 5798: All protocol messaging is performed using either IPv4 or IPv6 multicast datagrams and later: MAC Address in the following format: IPv4 case: 00-00-5E-00-01-{VRID}
    – fips123
    Commented Jun 12, 2018 at 17:24
  • 1
    That is not a multicast MAC address; it is a unicast source address. "The virtual router MAC address is used as the source in all periodic VRRP messages sent by the Master router to enable bridge learning in an extended LAN."
    – Ron Maupin ♦
    Commented Jun 12, 2018 at 17:32
  • @fips123, multicast MAC addresses are group addresses, so the I/G bit is set. IANA has reserved the 01-00-5E OUI with the IEEE for IPv4 multicast. Apparently, they are using the OUI without the I/G bit set for source addresses. In any case, the 00:00:5E:00:01:01 MAC address is not a multicast address, and a switch MAC table will learn it as a unicast address assigned to a specific interface.
    – Ron Maupin ♦
    Commented Jun 12, 2018 at 17:37
1

I finally found the solution 😸 YaY
On Cisco ME3400E the default port-type is UNI and it has to be set to NNI.

port-type nni

From official Cisco config guide:

Traffic is not switched between these ports, and all arriving traffic at UNIs or ENIs must leave on NNIs to prevent a user from gaining access to another user's private network.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.