DYNAMIC ROUTING TAB

IMPORTANT

Dynamic multicast routing is an early-access feature in SNS 4.6.

You must refer to the Known issues and Limitations and explanations on usage in the SNS 4.6 release notes before enabling this feature.

Definitions

  • Multicast source: source sender (e.g., video camera).

  • Multicast receiver: receiver of multicast traffic (subscribed to the multicast group).

  • Multicast group: multicast address (private, public, SSM).

  • (S,G) - multicast (Source, Group): source IP address and multicast group address pair.

  • IGMP (Internet Group Management Protocol): protocol used by a multicast receiver to subscribe to or unsubscribe from a multicast group.
  • PIM (Protocol Independent Multicast): family of multicast IP routing protocols
  • PIM-SM (PIM Sparse Mode): version of PIM that builds a distribution tree. This is a scalable version of the protocol, making it possible to manage multiple sources. The distribution tree can be:
    • In shared mode, by going through a Rendez-vous Point (Shared Tree or RPT),
    • Set up by recalculating the shortest path tree (SPT), through unicast routing.
  • PIM-SSM (PIM Source-Specific Multicast): version of PIM in which receivers know the source. When the receiver subscribes, the source IP address and multicast group address pair will be formed directly. This protocol is easier to set up than PIM-SM (no RP involved), but requires IGMPv3 and is meant for a more restricted application type.
  • RP (Rendez-vous Point): role held by a PIM-SM router. The RP is contacted to discover and indicate the multicast source.
    The SNS firewall can play this role.
  • BSR (BootStrap Router): role held by a PIM router. The BSR is elected from a list of candidates. Once it is elected, it will gather candidacies for the role of RP, then shares the table of multicast group/RP associations with other routers.
    The SNS firewall can play this role.

Configuring the interfaces

This involves defining the source/destination interfaces that participate in dynamic multicast routing (PIM protocol) and the IGMP protocol versions that these interfaces can accept. To allow packets originating from these protocols and going to the firewall’s interfaces, the Allow IGMP and PIM packets to be received for dynamic multicast routing to function implicit filter rule must be enabled.

Possible operations

Select all Selects all the lines shown in the grid to delete them in a single action.
Add Inserts a line after a selected line to add an interface.
Delete Deletes the selected line.

Adding an interface

NOTE
Bridges and bridged interfaces cannot be selected as multicast interfaces.

To add an interface to the list of interfaces participating in dynamic multicast routing:

  1. Select the line in the grid under which you want to create a new entry.
  2. Click on Add.
  3. Select the interface.
  4. Select the IGMP protocol version allowed for this interface: IGMP v2 only or IGMP v2 and IGMP v3.
  5. NOTE
    If you wish to use the PIM-SSM protocol, you must choose IGMP v2 and IGMP v3 because only IGMP v3 is compatible with this protocol.

  6. Specify the priority assigned to this interface.
    This concept of priority is important in an architecture with multiple access, in which several SNS firewalls or routers manage dynamic multicast routing over the same local network. As a matter of fact, priority makes it possible to elect the Designated Router (DR),which will then send requests to the Rendez-vous Point (RP) via the interface with the highest priority.
    The interface with the lowest priority number will have the highest priority in routing multicast traffic.
    If both interfaces have the same priority, the interface with the highest IP address will have priority.

Possible interactions

Some operations listed in the taskbar can be performed by right-clicking on the grid of interfaces:

  • Add,
  • Remove.

Be a candidate for the Bootstrap Router (BSR) role

In the Rendez-vous Point election mechanism, the BootStrap Router (BSR) that centralizes elections must be defined. If a BSR is already configured on the network, the SNS firewall cannot be a candidate.
However, if you want the SNS firewall to be eligible for election as a BSR, use this grid:

Address Select the network interface on the firewall that will be used as the firewall’s identifier in the election mechanism.
Stormshield recommends using a dedicated loopback interface for this purpose.
Loopback interfaces can be defined in Network > Virtual interfaces > Loopback tab.
More information on creating loopback interfaces.
Priority

This concept of priority is important in an architecture for which several devices are BSR candidates - the device that has the interface with the highest priority will be elected.

IMPORTANT
The interface with the highest number will have the highest priority.
If both interfaces have the same priority, the interface with the highest IP address will have priority.

Be a candidate for the Rendez-vous Point (RP) role

NOTE
Multicast groups must be very thoroughly managed (no address overlaps) so that the RP election mechanism can be used while static RPs are being defined.

The RP plays an essential role in how PIM-SM runs. If a RP is already configured on the network, the SNS firewall cannot be a candidate.
If you wish to register the firewall in the Rendez-vous Point election mechanism, use this grid.

Address Select the network interface on the firewall that will be used as the firewall’s identifier in the election mechanism.
Stormshield recommends using a dedicated loopback interface for this purpose.
Loopback interfaces can be defined in Network > Virtual interfaces > Loopback tab.
More information on creating loopback interfaces.
Priority

This concept of priority is important in an architecture for which several devices are RP candidates - the device that has the interface with the highest priority will be elected.

IMPORTANT
The interface with the lowest number will have the highest priority.
If both interfaces have the same priority, the interface with the highest IP address will have priority.

Possible operations:

  • To add a multicast group address belonging to the firewall that will be the potential RP, click on Add, then select (or create directly from this grid) the network object corresponding to this address.
  • To delete a multicast group address belonging to the firewall that will be the potential RP, select the corresponding line, then click on Delete.
  • To delete all multicast group addresses, click on Select all, then on Delete.

Static Rendez-vous Points (RP)

NOTE
Multicast groups must be very thoroughly managed (no address overlaps) so that the RP election mechanism can be used while static RPs are being defined.

If you wish to define static Rendez-vous Points (without going through an election mechanism), use this grid.

Possible operations:

  • To add a static RP definition, click on Add, then fill in the two fields below:
Range Multicast address range (multicast group) to which the RP is assigned.
This range may either be an existing custom range defined in the firewall’s network objects, or can be created directly from this grid.
Address IP address of the RP for this multicast group.
  • To delete a static RP definition, select the corresponding line and click on Delete.
  • To delete all static RP definitions, click on Select all, then on Delete.

Advanced configuration

Interval between two Hello messages Interval (in seconds) between two Hello packets sent to other devices that manage the PIM protocol.
The default value is 30 seconds.
Interval between two IGMP requests Interval (in seconds) between two requests for the purpose of gathering subscription requests from multicast receivers or detecting ended subscriptions.
The default value is 5 seconds.