IPSec tunneling involving Multicast

[matthew.scala]

Question.. my workcenter would like to set up a way to have our wireless/VPN users access IPTV content on our network. We will be using a VPNSM for the 6500 & will be implementing IPSec for encryption purposes. My research has concluded that IPsec does not directly support multicast as it was originally designed to encrypt unicast traffic only. Would it be possible to encapsulate the multicast traffic within a GRE tunnel & then encapsulate the GRE tunnel inside an IPSec tunnel? Any information is appreciated. Thanks for your time.

- Matt

[Richard Burts]

You are correct that IPSec is designed to handle unicast traffic not multicast. I have a customer who has implemented a lot of IPSec and needs multicast support. The solution we adopted is IPSec and GRE tunnels. It supports multicast very well. I think there is a significant difference between our implementation and what you are describing. In our implementation the GRE tunnels are between routers. I am guessing from your description that your IPSec is between the user PC and the 6500. I am not sure that GRE works between PC and router/switch.

HTH

Rick

[matthew.scala]

Rick,

Our VPN/wireless setup currently consists of multiple AP's that span across the base. These AP's connect back to the local closet switches, which then connect back to the ITN's (6500 L3.) A VPN concentrator is connected to one of the ITN's on both the public & private side. Separate VLAN/subnet for the public side & for the private side. Currently.. we are using Cisco's 3000 series VPN Concentrator which does NOT support multicast. As I stated previously, we ordered a VPN Services Module for one of our 6500's. The plan is to migrate the existing users from the 3000 Concentrator over to the 6500 with the VPNSM. Because these users are authenticating through the VPN.. an IPSec tunnel will be established all the way to the client. The GRE tunnels will work between the routers obviously. What I need to know is how can I get this to work so that the multicast traffic is carried all the way to the client? Thanks again.

- Matt