0

for a specific application, I need to route a multicast flow with IPSEC (we use a CISCO ASA 5508 firewall), I am not a network expert then I will try to explain as best as I can our issue I don't need any IGMP management everything is static:

  • on eth_input we receive "multicast" messages (meaning that destination address is in the multicast range ex: 229.0.0.X
  • on eth_output we need to forawrd these message in IPSEC message (defined by one IP public address for source and one IP public address for destination. On eth_output we disable IGMP

then basically the need is to forward statically the messages after encapsulation in IPSEC

On my side, I understand that multicast + IPSEC is not trivial, but I don't understand if this due to IGMP management only or not.

then my question:

  • is the routing problem due to the fact that our destination is in the multicast range (then root cause there is a limitation in the firewall that reject the routing configuration) ?
  • or is the routing problem due only to IGMP management with IPSEC (then in our case we will disable IGMP) ?

thanks very much for help

best regards

3
  • This post seems to lack a question, it's just a problem description. Please be specific in what you're asking.
    – Teun Vink
    Jan 26, 2021 at 7:16
  • thanks for feedback I have tried to clarify the questions
    – Gcomel
    Jan 26, 2021 at 10:45
  • 1
    IPSec does not actually support multicast. The way to do it is to first tunnel in GRE, then tunnel the GRE in IPSec. Cisco has a VTI (Virtual Tunnel Interface) solution to do that. By the way, the 229.0.0.X range is reserved, and you should not use it. The Organization-Local scope (239.0.0.0/8) is available for your use.
    – Ron Maupin
    Jan 26, 2021 at 13:51

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.