-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Yibran Montalvo wrote:
Hello,
Hello Yibran
The setup is the fallowing a Cisco 6500-firewall cluster-Cisco 7200. The
problem
comes when I try to make the joint to a multicast group the firewall block
it.
Is this IGMP traffic? Is just the IGMP join message getting dropped or
everything multicast?
I do suppose, you have an according rule, and antispoofing is set up
correctly ... and then, you need the right OS under your firewall. I'm
not familiar with Cisco product numbers, but I assume the 6500 and 7200
are Layer 3 switches. If they are (and not acting as multicast routers)
you have to turn your firewall into a multicast router. How to do this
depends on your FW OS (in IPSO, you enable it per interface on th PIM
configuration page, then fine-tune it in the IGMP config page)
The approach to resolve this came from the network technician and the
solution
was to create a GRE Tunnel between the two Cisco, this work well for some
time,
Oh, and how do you enforce your security policy? Who controls what goes
over that tunnel?
but the problem is we are starting to use some great collaborative
applications
that require 30MG of bandwidth incoming and outgoing simultaneous so there
will
be 60MG of traffic per conference.
Are we talking about 60 Mbit/sec network bandwidth? This is about the
maximum you will get out of a 100 Mbit NIC, so all your devices better
have GiGEthernet at least! Is the whole of your network QoS enabled?
What I am looking is ways to configure the checkpoint to permit the multicast
traffic go throw it. I am not a firewall expert but if some one can point me
in
the correct directions I will appreciate it.
See above. Find out which multicast group the devices (hosts) want to
join, and permit traffic to that destination for IGMP and the protocol
the application is using. Set up your firewalls as multicast routers.
If the hosts that are using the application are not directly connected
to the firewalls (i.e. have no layer 2 link to it), the intermediate
devices (routers) need to be configured for multicast routing as well.
hth /markus
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFCeydH8BX/d8pVi/cRAhKzAKCVNmdSgxz1IqIhVddqFTlNybnsLgCeOAzy
1U7UxcG3BFBebLwwJ8J8wl8=
=x8Co
-----END PGP SIGNATURE-----
