ASA Multicast Inside to Outside to 3850 Switch Help

[hoandsons]

Hi All,

Any help would be much appreicated!

======================================

ASA Version 8.4(4)1

multicast-routing

interface GigabitEthernet0/0
description OUTSIDE
nameif OUTSIDE
security-level 0
ip address 192.168.255.250 255.255.255.252
igmp static-group 239.190.70.10

!

interface GigabitEthernet0/3
nameif INSIDE
security-level 100
ip address 192.168.100.1 255.255.255.0
igmp join-group 239.190.70.10

interface GigabitEthernet0/1
nameif INSIDE2
security-level 100
ip address 192.168.101.1 255.255.255.0

!

route OUTSIDE 0.0.0.0 0.0.0.0 192.168.255.249

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Cisco 3850
version 15.2

ip routing
ip multicast-routing

interface GigabitEthernet1/1/4
description TO CISCO ASA
no switchport
ip address 192.168.255.249 255.255.255.252
ip pim sparse-mode
!

vlan 100
name MGMT

interface Vlan100
description MGMT
ip address 192.168.0.1 255.255.255.0
ip pim sparse-mode

!
ip pim rp-address 192.168.255.249

ip route 192.168.100.0 255.255.255.0 192.168.255.250
ip route 192.168.101.0 255.255.255.0 192.168.255.250

=====================================================
MULTICAST SOURCE 192.168.100.252 /24

MULTICAST DESTINATION 239.190.70.10

Multicast can be received on receiver on 192.168.101.0/24

Multicast cannot be received on 3850 on VLAN 100.

Multicast looks to be sending to GigabitEthernet1/1/4 (counters for multicast increasing however it stops there).

Can you anyone please help so that multicast can be sent from inside of ASA to outside to a receiver off the 3850 switch?

[Flavio Miranda]

Hello @hoandsons

I'm trying to understand your setup. Do you have a default route from asa to switch and static router from switch to asa?

-If I helped you somehow, please, rate it as useful.-

[hoandsons]

Hi,

There is a default route from ASA to Switch via

!ASA CONFIG

route OUTSIDE 0.0.0.0 0.0.0.0 192.168.255.249

!SWITCH CONFIG

ip route 192.168.100.0 255.255.255.0 192.168.255.250
ip route 192.168.101.0 255.255.255.0 192.168.255.250

There are static routes from switch to ASA for both inside interfaces.

Cheers

[Flavio Miranda]

But which is the idea? Packets will be sent from asa to switch through the default route and then they are routed back to asa  through static routes.

Is that what want? Don't make sense to me.

[hoandsons]

Hi,

For example, a host on the inside interface has an IP address of 192.168.100.100 is sending a multicast stream to 239.190.70.10.

The ASA has a default route up to the switch which has multiple VLANs and is routing between them. I only mention one VLAN 100 on the switch but this switch has multiple VLANs. This switch is connected to another router to get to the internet but isnt mentioned here because I thought it was irrelevant. That is why is static routes for particular inside networks off the asa pointing to the asa because this switch as a default route another router to get to the internet.

A host on VLAN 100 with IP address 192.168.0.100 wants to receive this multicast stream is hanging off the switch.

Basically, I would like to find out why I cant get multicast from inside interface on asa to a host on VLAN 100 on the 3850 switch.

Cheers

[Flavio Miranda]

Alrghit, that´s make sense. However, unless I am still missing something the Interface vlan 100 must be down on the switch. Can you run the command "show ip int br" on the switch please and share with me?

-If I helped you somehow, please, rate it as useful.-

[hoandsons]

Hi,

Yes you are right, sorry I forgot to mention that there is a interface on that vlan eg:

interface Gi1/0/1
description multicast receiver
switchport access vlan 100
switchport mode access
switchport
no shut

Please note that I can ping between source and destination.

[Flavio Miranda]

Now looks to me that ASA may be filtering multicast traffic. 

Did you applied any permission. As far as I can tell, multicast is not permit by default through firewall.

-If I helped you somehow, please, rate it as useful.-

[hoandsons]

Hi,

I have applied ip any any ACLS and igmp any any on all interfaces just for testing.

Cheers

[Flavio Miranda]

humm....dont think so. Multicast requires more than ACL. 

Take a look here  and here.

-If I helped you somehow, please, rate it as useful.-