Multicast Boot Strap Router (BSR)
Symptom
There is no option to configure the Next-Generation Firewall as a multicast Bootstrap Router (BSR.)
Environment
- NFGW Hardware and VM-Series
- Multicast environments
- Multicast routing enabled on the NGFW.
- PAN-OS
Cause
The firewall can be configured as a candidate Rendezvous Point (RP) in an a multicast domain that has one or more BSRs. However configuring the firewall as a BSR is not supported.
Resolution
Candidate RP can be configured on PAN-OS:
Network --> Virtual Routers --> Name --> Multicast --> Rendezvous Point
Additional Information
In the screenshot depicted above the firewall is advertising itself as a candidate RP for the multicast group 224.0.0.0/5. The BSR then broadcasts this RP to other multicast/PIM devices in the network dynamically:
Nexus7004# show ip pim rp
PIM RP Status Information for VRF "default"
BSR: 10.20.30.1*, next Bootstrap message in: 00:00:19,
priority: 64, hash-length: 30
Auto-RP disabled
BSR RP Candidate policy: None
BSR RP policy: None
Auto-RP Announce policy: None
Auto-RP Discovery policy: None
RP: 172.16.16.254, (0), uptime: 23:48:02, expires: 00:01:57,
priority: 100, RP-source: 172.16.16.254 (B), group ranges:
224.0.0.0/5
A downstream receiver and an upstream sender to this group are now able to join the shared tree and shortest path tree. In this topology both sender and receiver transit the firewall. Hence the shared tree and source tree can be seen on the firewall (RP for the multicast group)
admin@Lab32-52-PA-4050> show routing multicast pim state
VIRTUAL ROUTER: default
(*, G):
group RP up time upstream join st upstream join timer RPF interface RPF next hop
----- -- ------- ---------------- ------------------- ------------- ------------
224.0.1.2 172.16.16.254 8026.45 Joined 0.00 0 0.0.0.0
(*, G, I):
group interface local membership join/prune st prune pending timer join expiry timer assert st assert timer assert winner addr assert winner metric
----- --------- ---------------- ------------- ------------------- ----------------- --------- ------------ ------------------ --------------------
224.0.1.2 ethernet1/1 no Join 0.00 166.87 NoInfo 0.00 0.0.0.0 0
(S, G):
group source up time upstream nbr upstream join st upstream join timer RPF next hop DR reg st DR reg stop timer SPT
----- ------ ------- ------------ ---------------- ------------------- ------------ --------- ----------------- ---
224.0.1.2 172.17.17.1 67.36 0.0.0.0 Joined 0.00 172.17.17.1 Join 0.00 yes
(S, G, rpt):
group source up time upstream prune st upstream override timer
----- ------ ------- ----------------- -----------------------
224.0.1.2 172.17.17.1 67.39 Pruned 0
(S, G, rpt, I):
group source interface local membership join/prune st prune pending timer join expiry timer
The concept described above also applies to Advanced Routing Engine, since the system cannot act as a BSR except to send/relay Bootstrap Messages (BSM) when the Send BSM checkbox is checked. However, Legacy Routing Engine does not propagate BSM beyond the local multicast-enable interface when the BSR Border checkbox is marked on the interface.