for a specific application, I need to route a multicast flow with IPSEC (we use a CISCO ASA 5508 firewall), I am not a network expert then I will try to explain as best as I can our issue I don't need any IGMP management everything is static:

  • on eth_input we receive "multicast" messages (meaning that destination address is in the multicast range ex: 229.0.0.X
  • on eth_output we need to forawrd these message in IPSEC message (defined by one IP public address for source and one IP public address for destination. On eth_output we disable IGMP

then basically the need is to forward statically the messages after encapsulation in IPSEC

On my side, I understand that multicast + IPSEC is not trivial, but I don't understand if this due to IGMP management only or not.

then my question:

  • is the routing problem due to the fact that our destination is in the multicast range (then root cause there is a limitation in the firewall that reject the routing configuration) ?
  • or is the routing problem due only to IGMP management with IPSEC (then in our case we will disable IGMP) ?

thanks very much for help

best regards

  • This post seems to lack a question, it's just a problem description. Please be specific in what you're asking. – Teun Vink Jan 26 at 7:16
  • thanks for feedback I have tried to clarify the questions – Gcomel Jan 26 at 10:45
  • 1
    IPSec does not actually support multicast. The way to do it is to first tunnel in GRE, then tunnel the GRE in IPSec. Cisco has a VTI (Virtual Tunnel Interface) solution to do that. By the way, the 229.0.0.X range is reserved, and you should not use it. The Organization-Local scope ( is available for your use. – Ron Maupin Jan 26 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.