Why is Multicast not supported. S2S Ipsec VPN

GRANT3779 · ‎08-20-2014

I know that standard site to site ipsec vpns cannot run routing protocols over them but would like to know why the cannot, e.g what is the physical reason multicast cannot run over them? Is this due to the VPN being strictly peer to peer? This brings me to asking why, when using gre/ipsec tunnels multicast can run over it no problem. Is this due to the virtual interface?

Karsten Iwen · ‎08-20-2014

In principle, IPsec can also transport multicast. The problem is more or less that the initial standards did not include much for multicast. Some quotes from relevant RFCs:

RFC 2401: Security Architecture for the Internet Protocol
4.1 Definition and Scope
In principle, the Destination Address may be a unicast address, an IP broadcast address, or a multicast group address. However, IPsec SA management mechanisms currently are defined only for unicast SAs. Hence, in the discussions that follow, SAs will be described in the context of point-to-point communication, even though the concept is applicable in the point-to-multipoint case as well.
RFC 5406: Guidelines for Specifying the Use of IPsec Version 2
7. Broadcast and Multicast
Although the designers of IPsec tried to leave room for protection of multicast traffic, a complete design wasn't finished until much later. As such, many IPsec implementations do not support multicast. [RFC5374] describes extensions to IPsec to support it. Other relevant documents include [RFC3830], [RFC3547], and [RFC4535].
Because of the delay, protocol designers who use multicast should consider the availability of these extensions in target platforms of interest.

GRANT3779 · ‎08-21-2014

So does the above correspond to the reason why routing protocols can't be run over them?

Karsten Iwen · ‎08-21-2014

At least it corresponds to the early policy-based implementations with crypto-maps. And nowadays multicast is possible at least with VTIs which are route-based with an any to any encryption-domain.