PIM-SM over GRE and VPN config issue

[kkatsaros-dcat]

Hi,

I have been using the Linux distro of pimd (v 2.3.2) and my setup looks like this.

I have a host-A connecting over VPN to our Firewall which acts also as router with PIM-SM/IGMPv2
I have a GRE tunnel from Host-A over the VPN link (the gpd0 interface) to pass the multicast traffic terminating to the Firewall.

A second host-B (actually a VM in an openstack) is attached to the firewall through a switch.
Both the tun1 and eth1/1120 interfaces in the firewall are part of the same virtual router and I can confirm unicast routing from one to the other.

[HOST-A]

$ ping -I gre1 10.100.120.7
PING 10.100.120.7 (10.100.120.7) from 10.100.125.2 gre1: 56(84) bytes of data.
64 bytes from 10.100.120.7: icmp_seq=1 ttl=63 time=19.9 ms
64 bytes from 10.100.120.7: icmp_seq=2 ttl=63 time=34.9 ms

[HOST-B]

ping -I ens3 10.100.125.2
PING 10.100.125.2 (10.100.125.2) from 10.100.120.7 ens3: 56(84) bytes of data.
64 bytes from 10.100.125.2: icmp_seq=1 ttl=63 time=107 ms
64 bytes from 10.100.125.2: icmp_seq=2 ttl=63 time=140 ms

PIM-SM is running on both hosts (pimd) and on the Firewall.

[HOST-A]

sudo pimd -r
Virtual Interface Table ======================================================
Vif  Local Address    Subnet              Thresh  Flags      Neighbors
---  ---------------  ------------------  ------  ---------  -----------------
  0  192.168.0.76     192.168                  1  DISABLED
  1  10.100.121.241   10.100.121.241/32      255  DR NO-NBR
  2  10.100.125.2     10.100.125/30          255  DR NO-NBR
  3  10.100.121.241   register_vif0            1

 Vif  SSM Group        Sources

Multicast Routing Table ======================================================
--------------------------------- (*,*,G) ------------------------------------
Number of Groups: 0
Number of Cache MIRRORs: 0
------------------------------------------------------------------------------

[HOST-B]

$ sudo pimd -r
Virtual Interface Table ======================================================
Vif  Local Address    Subnet              Thresh  Flags      Neighbors
---  ---------------  ------------------  ------  ---------  -----------------
  0  10.100.120.7     10.100.120/24            1  DR NO-NBR
  1  10.100.120.7     register_vif0            1

 Vif  SSM Group        Sources

Multicast Routing Table ======================================================
--------------------------------- (*,*,G) ------------------------------------
Number of Groups: 0
Number of Cache MIRRORs: 0
------------------------------------------------------------------------------

The RP is set up on the Firewall is 10.100.122.1
My pimd.conf config file looks like this

[HOST A]

default-route-distance 101
phyint wlan0 disable
phyint gre1 enable igmpv2 ttl-threshold 255
phyint gpd0 enable igmpv2 ttl-threshold 255
rp-candidate  gre1
                group-prefix 239.0.0.0/8
rp-address    10.100.122.1 239.0.0.0/8
spt-threshold packets 0 interval 100

[HOST B]

bsr-candidate priority 5
rp-candidate time 30 priority 20
group-prefix 239.0.0.0 masklen 8
rp-address 10.100.122.1 239.0.0.0/8
spt-threshold packets 0 interval 100

Firewall config

It has identified PIM neighbours

I'm using mcjoin to test the multicast, with te sender in the HOST-B and receiver in HOST-A but with no luck.

                                                 mcjoin :: receiving multicast                                                    45s

dc5g (10.100.125.2@gre1) [Help | Toggle | Quit] Fri Sep 24 17:22:57 2021
Source,Group Plotter Rate Bytes Packets
*,239.1.2.3 \ [ ] 0.0k 0.0k 0

Time Log
Fri Sep 24 17:22:12 2021 Joining (*,239.1.2.3) on gre1, ifindex: 14, sd: 5
Fri Sep 24 17:22:58 2021 *,239.1.2.3: invalid 0 delay 0 gaps 0 reorder 0 dupes 0 bytes 0 packets 0
Fri Sep 24 17:22:58 2021 Total: 0 packets
Fri Sep 24 17:22:58 2021 Uptime: 46s

mcjoin :: sending multicast 14s
5gf-vm3 (10.100.120.7@ens3) [Help | Toggle | Quit] Fri Sep 24 16:22:59 2021
Source,Group Plotter Packets
*,239.1.2.3 \ [...............................................................................................................] 141

Time Log
Fri Sep 24 16:22:45 2021 Sending IPv4 multicast on ens3 addr, 10.100.120.7 ifindex: 2, sd: 5
Fri Sep 24 16:22:59 2021 *,239.1.2.3: invalid 0 delay 0 gaps 0 reorder 0 dupes 0 bytes 14100 packets 141
Fri Sep 24 16:22:59 2021 Total: 141 packets
Fri Sep 24 16:22:59 2021 Uptime: 14s

My concern is if the pimd.comf is correctly created. I am not an expert in multicast to be honest. Any support would be appreciated.

[troglobit]

I'm not sure I understand your setup, and the report was quite hard to read. I tried to add some Markdown markup to fix things ...

From what I can see, HOST-A doesn't seem to find any PIM neighbors, so a bit hard to do some routing then. You don't show how you've set up your GRE tunnel, but I suspect you've forgot to set the MULTICAST interface flag. I actually wrote a blog post about this a few years ago that might be helpful. Please let me know if it works for you.

https://troglobit.com/2016/07/05/multicast-routing-with-pim-sm-over-gre/

Also, this is more of a support issue rather than bug report, so I'm moving this to Discussions.

[troglobit]

You need to tell more about how you built the repo version, I'm suspecting you didn't supply configure arguments that match your system. It looks like the paths to both the IPC socket and the PID file don't exist. Also, why are you using a ttl-threshold of 255 and a linebreak in the rp-candidate? Don't you want to use gre1 and gpd0 for multicast routing? Have you read any of the documentation?

[kkatsaros-dcat]

I built it following the documentation here "Buildinf from Git"

./autogen.sh
./configure && make
sudo make install-strip

I want to use gre1 and gpd0 for multicast that's why I have enabled them as per documentation, and specifically I want them to be igmpv2 The ttl 255 is in accordance with the TTL I have set in the other side of my system (the Firewall)

The line break is in the default config file. I just uncommented the line and modified accorndingly. If I put it in single line like this
rp-candidate gre1 group-prefix 239.122.0.0/16
I get this error

pimd: 23:50:42.708 pimd version 3.0-beta1 starting ...
pimd: 23:50:42.709 pimd.conf:0 - Skipping interface lo, does not support multicast.
pimd: 23:50:42.710 pimd.conf:37 - Invalid Cand-RP address 'group-prefix', defaulting to 10.100.125.2
pimd: 23:50:42.710 pimd.conf:37 - Invalid Cand-RP address '239.122.0.0/16', defaulting to 10.100.125.2
pimd: 23:50:42.711 Failed binding IPC socket, client disabled: No such file or directory
pimd: Cannot create pidfile: No such file or directory

[kkatsaros-dcat]

I enabled debug and I have a bit more info to show:

sudo pimd -f pimd2.conf -n --disable-vifs -l debug
pimd: 00:26:43.193 pimd version 3.0-beta1 starting ...
pimd: 00:26:43.195 pimd2.conf:0 - Skipping interface lo, does not support multicast.
pimd: 00:26:43.196 phyint lo (127.0.0.1) disabled, skipping VIF
pimd: 00:26:43.196 phyint wlan0 (192.168.0.76) disabled, skipping VIF
pimd: 00:26:43.196 VIF #1: Installing gpd0 (10.100.121.241 -> 10.100.121.241) rate 0
pimd: 00:26:43.196 VIF #2: Installing gre1 (10.100.125.2 -> 10.100.125.2) rate 0
pimd: 00:26:43.196 VIF #0: Installing pimreg, using gre1 with ifaddr 10.100.125.2
pimd: 00:26:43.196 default-route-distance is 101
pimd: 00:26:43.196 hello-interval is 30
pimd: 00:26:43.196 Local static RP: 10.100.122.1, group 239.122.0.0/16
pimd: 00:26:43.196 Local static RP: 169.254.0.1, group 232.0.0.0/8
pimd: 00:26:43.196 VIF #1: now in service, interface gpd0 UP
pimd: 00:26:43.197 VIF #2: now in service, interface gre1 UP
pimd: 00:26:43.198 VIF #0: now in service, interface pimreg UP
pimd: 00:26:43.198 For src 10.100.122.1, iif is 1, next hop router is 10.100.122.1: NOT A PIM ROUTER
pimd: 00:26:43.199 Binding IPC socket to /usr/local/var/run/pimd.sock
pimd: 00:26:43.199 Failed binding IPC socket, client disabled: No such file or directory
pimd: Cannot create pidfile: No such file or directory

Looks like it does not understand that there is a PIM router at 10.100.122.1
That's the PaloAlto firewall and I know that it has PIM and I have confirmed that it works with a CISCO router.

[ruckc]

I think the /usr/local/var/run directory just doesn't exist

[troglobit]

OK, the section of the README you reference is an example. You still need to know how how to use the configure flags, which is mentioned elsewhere in the documentation.

I suggest you remove the ttl-threshold from your config, a threshold of 255 means the TTL of incoming multicast must be > 255, which is not possible. Drop it from your pimd.conf until you've got the routers to peer, and you see routed multicast, then you can start playing around with advanced settings.

Now, I still don't understand your setup, from the picture and the .conf you seem to want to peer with the PaloAlto on gpd0 and gre1, why? The GRE tunnel from host A is terminated in the firewall, right? I think pimd gets confused by this, it cannot find the IP of the firewall in its list of peered routers, and you also risk routing data between those two links back and forth with the firewall. Also, if host's A and B are end devices you shouldn't need to even run PIM on them, only on the router between the LAN segments ...