Example PIM configuration that uses BSR to find the RP

Adding the NAT multicast policy

In this example, the incoming multicast policy does the address translation.

The NAT address should be the same as the IP address of the of loopback interface. The DNAT address is the translated address, which should be a new group.

config firewall multicast-policy edit 1

set dstintf port6

set srcintf lo0 next

edit 2

set dnat 238.1.1.1 set dstintf lo0

set nat 1.4.50.4 set srcintf port1

next

 

Configuration steps

In this sample, FortiGate-500A_1 is the RP for the group 228.1.1.1, 237.1.1.1, 238.1.1.1, and FortiGate-500A_4 is the RP for the other group which has a priority of1. OSPF is used in this example to distribute routes including the loopback interface. All firewalls have full mesh security policies to allow any to any.

  • In the FortiGate-500A_1 configuration, the NAT policy translates source address 236.1.1.1 to 237.1.1.1
  • In the FortiGate-500A_4, configuration, the NAT policy translates source 236.1.1.1 to 238.1.1.1
  • Source 236.1.1.1 is injected into network as well.

 

The following procedures include the CLI commands for configuring each of the FortiGate units in the example configuration.

 

To configure FortiGate-500A_1

1. Configure multicast routing.

config router multicast config interface

edit port5

set pim-mode sparse-mode next

edit port4

set pim-mode sparse-mode next

edit lan

set pim-mode sparse-mode next

edit port1

set pim-mode sparse-mode next

edit lo999

set pim-mode sparse-mode next

edit lo0

set pim-mode sparse-mode set rp-candidate enable set rp-candidate-group 1

next end

set multicast-routing enable config pim-sm-global

set bsr-candidate enable set bsr-interface lo0

end end

2. Add multicast security policies.

config firewall multicast-policy edit 1

set dstintf port5 set srcintf port4

next edit 2

set dstintf port4 set srcintf port5

next edit 3 next

end

3. Add router access lists.

config router access-list edit 1

config rule edit 1

set prefix 228.1.1.1 255.255.255.255 set exact-match enable

next edit 2

set prefix 237.1.1.1 255.255.255.255 set exact-match enable

next edit 3

set prefix 238.1.1.1 255.255.255.255 set exact-match enable

next end

next end

 

To configure FortiGate-500A_2

1. Configure multicast routing.

config router multicast config interface

edit “lan”

set pim-mode sparse-mode

next

edit “port5”

set pim-mode sparse-mode

next

edit “port2”

set pim-mode sparse-mode next

edit “port4”

set pim-mode sparse-mode next

edit “lo_5”

set pim-mode sparse-mode config join-group

edit 236.1.1.1 next

end next

end

set multicast-routing enable end

2. Add multicast security policies.

config firewall multicast-policy edit 1

set dstintf lan set srcintf port5

next edit 2

set dstintf port5 set srcintf lan

next edit 4

set dstintf lan set srcintf port2

next edit 5

set dstintf port2 set srcintf lan

next edit 7

set dstintf port1 set srcintf port2

next edit 8

set dstintf port2 set srcintf port1

next edit 9

set dstintf port5 set srcintf port2

next edit 10

set dstintf port2 set srcintf port5

next edit 11

set dnat 237.1.1.1 set dstintf lo_5 set nat 5.5.5.5

set srcintf port2 next

edit 12

set dstintf lan set srcintf lo_5

next edit 13

set dstintf port1 set srcintf lo_5

next edit 14

set dstintf port5 set srcintf lo_5

next edit 15

set dstintf port2 set srcintf lo_5

next edit 16 next

end


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To visit the YouTube Channel for the latest Fortinet Training Videos and Question / Answer sessions!
- FortinetGuru YouTube Channel
- FortiSwitch Training Videos