topic You can try to permit the in Network Security

ASA Multicast routing help please

ksherwood — Tue, 26 Mar 2019 00:55:25 GMT

Hello all,

I have two ASA connected together and can't seem to get a multicast stream out the other end.

There are so many options I am confused on what to use.

Here is my network: Source --> outside-ASA1-inside --> ouside-ASA2-inside -> destination

I want the stream to be seen on ASA2 inside but it doesn't get there !

What minimal commands do I need to effect this other than "multicast-routing" ?

Can someone please help me configure both ASA with source sending 224.1.1.1 (make up IPs on all interfaces)

Thanks in advance.

Do you have Access Rules

Andre Neethling — Wed, 11 Mar 2015 09:59:10 GMT

Do you have Access Rules allowing the Multicast traffic on both ASAs in both directions? Are you trying to enable something Specific like BGP?

Hi Andre, I tried to simplify

ksherwood — Wed, 11 Mar 2015 10:55:21 GMT

Hi Andre, I tried to simplify things first so I used "permit IP any any". No specific routing enabled, just the simple mcast stream required. So can you give me a quick template with made up addressing for both ASAs. I just need the minimal config to give me confidence to proceed.

Thanks.

Hi. Can you please post the

Andre Neethling — Wed, 11 Mar 2015 12:19:31 GMT

Hi. Can you please post the config of both ASAs?

You can try to permit the

Andre Neethling — Wed, 11 Mar 2015 21:17:53 GMT

You can try to permit the entire Multicast range of 224.0.0.0/12 through all interfaces in both directions the stream will flow through.

I've got this on the first

ksherwood — Fri, 13 Mar 2015 08:46:08 GMT

I've got this:

1st ASA

multicast-routing
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.1.1.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.10.1 255.255.255.0
!
access-list mcastallowed extended permit udp any host 239.1.1.1
access-group mcastallowed in interface outside
route inside 0.0.0.0 0.0.0.0 192.168.10.2 1

2nd ASA

multicast-routing
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 192.168.10.2 255.255.255.0
igmp join-group 239.1.1.1
!
interface GigabitEthernet0/1
nameif inside
security-level 50
ip address 192.168.11.1 255.255.255.0
igmp forward interface outside
!
access-list mcastallowed extended permit udp any host 239.1.1.1
access-group mcastallowed in interface outside
route outside 131.1.1.0 255.255.255.0 192.168.10.1 1