PIX515E - how to allow multicast IGMP to pass through the firewall

[cls3152]

I'm looking to be able to join a multicast group from inside the firewall and then pass the multicast data into the firewall. Can anyone help? Here is my config that works for unicast traffic. We're running OS 6.3(4)

-chris.

interface ethernet0 10baset
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pix-1

domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
pager lines 22
mtu outside 1500
mtu inside 1500
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
console timeout 0
terminal width 80
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local

names
name 198.97.96.143 BridgeEIOM
name 198.97.96.144 FWOutside
name 205.71.113.129 FWInside
name 205.71.113.131 LeeHelm
name 205.71.113.132 Helm
name 205.71.113.135 Conn2
name 205.71.113.138 Nav1
name 205.71.113.140 Nav3
name 198.97.98.178 ASU

ip address outside FWOutside 255.255.255.192
ip address inside FWInside 255.255.255.224

global (outside) 1 interface
nat (inside) 1 0 0
route outside 0 0 BridgeEIOM
access-list AllTraffic permit ip any any
access-group AllTraffic in interface outside

multicast interface outside
multicast interface inside
igmp forward interface outside
mroute 205.71.114.66 255.255.255.248 outside 225.2.1.14 255.255.255.255 inside

static (inside,outside) FWOutside FWInside netmask 255.255.255.224

http server enable
http Helm 255.255.255.255 inside
http LeeHelm 255.255.255.255 inside

 

[mbilgrav]

did you solve your problem ?

 

[cls3152]

no, problem still persists....all other traffic seems to work fine, just multicast, i'm sure i'm just missing something small.

 

[cls3152]

still no solution................

 

[KiscoKid]

Can you clarify which side of the PIX the receiving IGMP hosts are and which side the multicast source is?

Also I'm not sure what the default setting is for the allowed number of multicast groups allowed, therefore I'd probably try setting the 'igmp max-groups <number>' command to something non-zero but preferanly something close to the number of multicast groups you want to support.