Documentation
VyOS Documentation
Routing in VyOS
Multicast

Multicast - Multicast Routing

Overview

Multicast Routing enables efficient delivery of data from a single source to many receivers at the same time. This is critically important for streaming applications such as:

  • IPTV and streaming video
  • Video conferencing
  • Software distribution
  • Real-time financial data
  • Online gaming

VyOS supports multicast routing through integration with FRRouting (FRR), providing full support for the IGMP and PIM protocols.

Core Concepts

Multicast Addressing:

  • IPv4 range: 224.0.0.0/4 (224.0.0.0 - 239.255.255.255)
  • 224.0.0.0/24 - reserved addresses for the local network
  • 239.0.0.0/8 - administratively scoped addresses (for private networks)

Multicast Groups:

  • Receivers join groups by the group IP address
  • Sources send data to the group address
  • Routers deliver traffic only to interested receivers

Protocols:

  • IGMP (Internet Group Management Protocol): manages group membership between hosts and routers
  • PIM (Protocol Independent Multicast): routes multicast traffic between routers
  • MSDP (Multicast Source Discovery Protocol): exchanges source information between domains

Multicast Routing Architecture

Core Components

Source:

  • A node that sends multicast traffic
  • Identified by its IP address

Group:

  • A set of receivers interested in the data
  • Identified by a multicast IP address

RPF (Reverse Path Forwarding):

  • A mechanism that verifies a packet arrived over the shortest path toward the source
  • Prevents routing loops

Multicast RIB (MRIB):

  • A separate routing table for multicast
  • Used for RPF checks

Distribution Tree Types

SPT (Shortest Path Tree):

  • The shortest-path tree from the source to receivers
  • Optimal latency
  • More state on the routers
  • Notation: (S,G) - Source, Group

RPT (Rendezvous Point Tree):

  • A shared tree through a rendezvous point (RP)
  • Less state on the routers
  • Possible suboptimal routing
  • Notation: (*,G) - Any Source, Group

Static Multicast Routes

VyOS supports static multicast routes to control RPF checks. These routes are used only to determine the reverse path and do not affect ordinary unicast routing.

Basic Configuration

Static route with next-hop:

set protocols static mroute <subnet> next-hop <address>
set protocols static mroute <subnet> next-hop <address> distance <distance>

Parameters:

  • <subnet> - network address of the multicast traffic source
  • <address> - IP address of the next hop for RPF
  • <distance> - administrative distance (optional, default 1)

Static route via an interface:

set protocols static mroute <subnet> interface <interface>
set protocols static mroute <subnet> interface <interface> distance <distance>

Parameters:

  • <interface> - outgoing interface for the RPF check

Disabling a route:

set protocols static mroute <subnet> next-hop <address> disable
set protocols static mroute <subnet> interface <interface> disable

Configuration Examples

Example 1: Basic static mroute

# Configure a static route for source 10.100.50.0/24
configure
set protocols static mroute 10.100.50.0/24 next-hop 192.168.1.1
commit
save

Example 2: Multiple routes with different metrics

configure
# Primary path with a low metric
set protocols static mroute 10.200.0.0/16 next-hop 192.168.1.1 distance 10

# Backup path with a high metric
set protocols static mroute 10.200.0.0/16 next-hop 192.168.2.1 distance 20
commit
save

Example 3: Route via an interface

configure
# Multicast traffic from sources in 172.16.0.0/12 is expected on eth1
set protocols static mroute 172.16.0.0/12 interface eth1
commit
save

Important Notes

Caution: Static multicast routes should be used with care. In most cases they are not required, because dynamic routing protocols (PIM) handle RPF automatically.

Limitations:

  • Routes are used only for RPF checks
  • Are not inserted into the kernel routing table
  • Are not processed by ZEBRA for ordinary routing
  • Can create “strange states” if misconfigured

Use cases:

  • Resolving RPF conflicts in complex topologies
  • Overriding unicast routes for multicast traffic
  • Supporting asymmetric routing

Multicast Forwarding (MFIB)

The Multicast Forwarding Table

MFIB (Multicast Forwarding Information Base) is the data structure used to forward multicast packets.

Key elements:

  • (S,G) entries: an entry for a specific source and group
  • (*,G) entries: an entry for all sources of a given group
  • IIF (Incoming Interface): the interface on which traffic is expected
  • OIL (Outgoing Interface List): the list of interfaces used for forwarding

Interface States

Incoming Interface (IIF):

  • Determined by the RPF check
  • Only one IIF per (S,G)
  • Packets are accepted only from the IIF

Outgoing Interfaces (OIF):

  • Interfaces with active receivers
  • Managed by IGMP/PIM
  • May include tunnels and virtual interfaces

The Forwarding Process

  1. Packet reception: verify that the packet arrived through the IIF
  2. RPF check: if it fails, the packet is dropped
  3. TTL scope: check the TTL boundary
  4. Forwarding: copy the packet to every OIF in the list

IGMP - Internet Group Management Protocol

IGMP manages host membership in multicast groups. VyOS supports IGMPv2 and IGMPv3.

Main Versions

IGMPv2:

  • Support for basic join/leave operations
  • Querier elections
  • Fast leave process

IGMPv3:

  • Source-Specific Multicast (SSM)
  • Source filtering (INCLUDE/EXCLUDE)
  • Backward compatibility with IGMPv2

IGMP Configuration

Enabling IGMP on an interface:

set protocols igmp interface <interface>

Setting the IGMP version:

set protocols igmp interface <interface> version <2|3>

Query intervals:

# Query interval (seconds, default 125)
set protocols igmp interface <interface> query-interval <seconds>

# Query max-response-time (tenths of a second, default 100)
set protocols igmp interface <interface> query-max-response-time <value>

Join settings:

# Static join to a group
set protocols igmp interface <interface> join <group-address>

# Join with a specified source (SSM)
set protocols igmp interface <interface> join <group-address> source <source-address>

IGMP Configuration Example

configure

# Configure IGMP on the LAN interface
set protocols igmp interface eth1
set protocols igmp interface eth1 version 3
set protocols igmp interface eth1 query-interval 125
set protocols igmp interface eth1 query-max-response-time 100

# Static join (for testing)
set protocols igmp interface eth1 join 239.1.1.1

commit
save

PIM - Protocol Independent Multicast

PIM provides multicast traffic routing between routers. VyOS supports PIM-SM (Sparse Mode) and PIM-SSM (Source-Specific Multicast).

PIM Operating Modes

PIM-SM (Sparse Mode):

  • Uses a Rendezvous Point (RP)
  • Efficient for sparsely distributed receivers
  • Supports (*,G) and (S,G) trees

PIM-SSM (Source-Specific Multicast):

  • Only (S,G) trees
  • Does not require an RP
  • Address range: 232.0.0.0/8
  • Requires IGMPv3

Basic PIM Configuration

Enabling PIM:

set protocols pim interface <interface>

Configuring the RP (for PIM-SM):

# Static RP
set protocols pim rp address <IP-address>

# RP for specific groups
set protocols pim rp address <IP-address> group <group-address/prefix>

Configuring the SSM range:

set protocols pim ssm-range <prefix>

Keep-alive timer:

set protocols pim interface <interface> hello-interval <seconds>
set protocols pim interface <interface> dead-interval <seconds>

Advanced PIM Settings

DR Priority:

# Designated Router priority (default 1)
set protocols pim interface <interface> dr-priority <0-4294967295>

Registration with the RP:

# Null-register suppression
set protocols pim register-suppress-time <seconds>

BSR (Bootstrap Router):

# Configure the BSR candidate
set protocols pim bsr-candidate interface <interface>
set protocols pim bsr-candidate priority <0-255>

PIM-SM Configuration Example

configure

# Enable PIM on the interfaces
set protocols pim interface eth0
set protocols pim interface eth1
set protocols pim interface eth2

# Configure hello intervals
set protocols pim interface eth0 hello-interval 30
set protocols pim interface eth1 hello-interval 30
set protocols pim interface eth2 hello-interval 30

# Configure the Rendezvous Point
set protocols pim rp address 10.0.0.1
set protocols pim rp address 10.0.0.1 group 239.0.0.0/8

# Configure DR priority on the upstream interface
set protocols pim interface eth0 dr-priority 100

commit
save

PIM-SSM Configuration Example

configure

# Enable PIM on the interfaces
set protocols pim interface eth0
set protocols pim interface eth1

# Configure the SSM range
set protocols pim ssm-range 232.0.0.0/8

# IGMP version 3 is mandatory for SSM
set protocols igmp interface eth1 version 3

commit
save

SSM - Source-Specific Multicast

SSM is an enhanced multicast model in which receivers explicitly specify the sources they want to receive data from.

SSM Advantages

Security:

  • Receivers select only trusted sources
  • Prevents DoS attacks through unknown sources

Simplicity:

  • Does not require a Rendezvous Point
  • Simplified configuration
  • Only SPT trees (S,G)

Efficiency:

  • Optimal paths from source to receivers
  • No initial period on the RPT

SSM Address Ranges

IPv4: 232.0.0.0/8

  • Standardized by RFC 4607
  • Reserved exclusively for SSM

Example allocation:

  • 232.0.0.0/24 - local tests
  • 232.1.0.0/16 - corporate use
  • 232.2.0.0/16 - provider services

SSM Configuration

Full SSM configuration:

configure

# Configure IGMP v3 on the client interfaces
set protocols igmp interface eth1 version 3
set protocols igmp interface eth2 version 3

# Enable PIM
set protocols pim interface eth0
set protocols pim interface eth1
set protocols pim interface eth2

# Define the SSM range
set protocols pim ssm-range 232.0.0.0/8

# Optional: add custom ranges
set protocols pim ssm-range 239.232.0.0/16

commit
save

Static join (SSM):

# A client joins a group with a specific source
set protocols igmp interface eth1 join 232.1.1.1 source 10.100.50.10

Practical Examples

Example 1: IPTV Distribution in Yandex Cloud

Scenario: An IPTV provider in Yandex Cloud distributes television channels to users across different subnets.

Topology:

  • IPTV source: 10.100.50.10
  • Multicast groups: 239.1.1.0/24 (channels)
  • VyOS router: edge gateway
  • Client networks: 10.200.1.0/24, 10.200.2.0/24

Configuration:

configure

# Interfaces
# eth0 - uplink to the IPTV source
# eth1 - client network 1
# eth2 - client network 2

# Enable IGMP on the client interfaces
set protocols igmp interface eth1 version 3
set protocols igmp interface eth1 query-interval 125
set protocols igmp interface eth1 query-max-response-time 100

set protocols igmp interface eth2 version 3
set protocols igmp interface eth2 query-interval 125
set protocols igmp interface eth2 query-max-response-time 100

# Enable PIM on all interfaces
set protocols pim interface eth0
set protocols pim interface eth1
set protocols pim interface eth2

# Configure hello intervals
set protocols pim interface eth0 hello-interval 30
set protocols pim interface eth1 hello-interval 30
set protocols pim interface eth2 hello-interval 30

# Configure the RP (the router itself)
set protocols pim rp address 10.100.1.1
set protocols pim rp address 10.100.1.1 group 239.1.0.0/16

# Raise DR priority on the uplink
set protocols pim interface eth0 dr-priority 100

# Optimization: static mroute for RPF
set protocols static mroute 10.100.50.0/24 interface eth0

# Configure firewall for multicast (if required)
set firewall group network-group MULTICAST_SOURCES network 10.100.50.0/24
set firewall name WAN_IN rule 100 action accept
set firewall name WAN_IN rule 100 source group network-group MULTICAST_SOURCES
set firewall name WAN_IN rule 100 destination address 239.0.0.0/8
set firewall name WAN_IN rule 100 protocol udp

commit
save

Verification:

# Check IGMP groups
show ip igmp groups

# Check PIM neighbors
show ip pim neighbor

# Check multicast routes
show ip mroute

# Check a specific group
show ip mroute 239.1.1.10

# IGMP statistics
show ip igmp interface eth1

# PIM interfaces
show ip pim interface

Example 2: Video Conferencing in VK Cloud

Scenario: A corporate video conferencing system uses SSM to distribute video streams between branch offices in VK Cloud.

Topology:

  • Office A: 192.168.10.0/24
  • Office B: 192.168.20.0/24
  • Office C: 192.168.30.0/24
  • SSM range: 232.10.0.0/16
  • VyOS routers in each office

Configuration (central router):

configure

# Interfaces to the branch offices
# eth1 - Office A (192.168.10.0/24)
# eth2 - Office B (192.168.20.0/24)
# eth3 - Office C (192.168.30.0/24)

# IGMP version 3 is mandatory for SSM
set protocols igmp interface eth1 version 3
set protocols igmp interface eth2 version 3
set protocols igmp interface eth3 version 3

# Short query intervals for fast response
set protocols igmp interface eth1 query-interval 60
set protocols igmp interface eth2 query-interval 60
set protocols igmp interface eth3 query-interval 60

# Enable PIM
set protocols pim interface eth1
set protocols pim interface eth2
set protocols pim interface eth3

# Configure the SSM range
set protocols pim ssm-range 232.0.0.0/8
set protocols pim ssm-range 232.10.0.0/16

# Short hello intervals for fast convergence
set protocols pim interface eth1 hello-interval 15
set protocols pim interface eth2 hello-interval 15
set protocols pim interface eth3 hello-interval 15

# QoS for multicast traffic (optional)
set qos policy shaper OFFICE_OUT bandwidth 100mbit
set qos policy shaper OFFICE_OUT class 10 bandwidth 50mbit
set qos policy shaper OFFICE_OUT class 10 match VIDEO_CONFERENCE ip destination address 232.10.0.0/16
set qos policy shaper OFFICE_OUT class 10 priority 1
set qos policy shaper OFFICE_OUT default bandwidth 50mbit

set interfaces ethernet eth1 qos-policy out OFFICE_OUT
set interfaces ethernet eth2 qos-policy out OFFICE_OUT
set interfaces ethernet eth3 qos-policy out OFFICE_OUT

commit
save

Client configuration (for testing):

On a Linux client, to join an SSM group:

# Utility for the SSM join
ip maddr add 232.10.1.1 dev eth0

# Or with a specified source (IGMPv3)
# Requires a special application that supports SSM
# For example, VLC with the parameters:
vlc udp://@232.10.1.1:5000 --miface=eth0 --program-ssrc=192.168.10.100

Verifying SSM:

# Check (S,G) entries
show ip mroute

# You should see entries such as:
# (192.168.10.100, 232.10.1.1)
# (192.168.20.50, 232.10.1.2)

# Check IGMP groups with sources
show ip igmp groups

# PIM upstream state
show ip pim upstream

# Statistics for the group
show ip mroute 232.10.1.1

Example 3: Comprehensive Configuration with Multiple RPs

Scenario: A large network with multicast domain separation and RP redundancy.

configure

# ========================================
# Basic interface settings
# ========================================

# Upstream interfaces
set protocols igmp interface eth0
set protocols igmp interface eth0 version 3
set protocols pim interface eth0
set protocols pim interface eth0 dr-priority 100

# Downstream interfaces
set protocols igmp interface eth1 version 3
set protocols igmp interface eth2 version 3
set protocols igmp interface eth3 version 3

set protocols pim interface eth1
set protocols pim interface eth2
set protocols pim interface eth3

# ========================================
# Configuring multiple RPs
# ========================================

# Primary RP for general groups
set protocols pim rp address 10.0.1.1
set protocols pim rp address 10.0.1.1 group 239.0.0.0/16

# Dedicated RP for video (239.1.x.x)
set protocols pim rp address 10.0.2.1
set protocols pim rp address 10.0.2.1 group 239.1.0.0/16

# RP for audio (239.2.x.x)
set protocols pim rp address 10.0.3.1
set protocols pim rp address 10.0.3.1 group 239.2.0.0/16

# SSM range (no RP)
set protocols pim ssm-range 232.0.0.0/8

# ========================================
# Static mroute for RPF control
# ========================================

# Video sources
set protocols static mroute 10.100.0.0/16 next-hop 10.0.1.254 distance 10

# Backup path
set protocols static mroute 10.100.0.0/16 next-hop 10.0.2.254 distance 20

# ========================================
# Timer optimization
# ========================================

# Fast convergence on critical interfaces
set protocols pim interface eth0 hello-interval 15
set protocols pim interface eth1 hello-interval 30
set protocols pim interface eth2 hello-interval 30
set protocols pim interface eth3 hello-interval 30

# IGMP query optimization
set protocols igmp interface eth1 query-interval 60
set protocols igmp interface eth2 query-interval 60
set protocols igmp interface eth3 query-interval 60

# ========================================
# Logging and debugging
# ========================================

# Enable PIM logs (optional, for debugging)
# set protocols pim log-neighbor-changes

commit
save

Verification and Monitoring Commands

Basic show Commands

Multicast routing table:

# Full multicast routing table
show ip mroute

# A specific group
show ip mroute 239.1.1.1

# Active sources only
show ip mroute active

# Detailed information
show ip mroute detail

# Statistics
show ip mroute count

show ip mroute output:

IP Multicast Routing Table
Flags: S - Sparse, C - Connected, P - Pruned
       R - RP-bit set, F - Register flag, T - SPT-bit set

(10.100.50.10, 239.1.1.1), uptime 00:15:23, flags: SCT
  Incoming interface: eth0, RPF neighbor 10.100.1.254
  Outgoing interface list:
    eth1, uptime 00:15:23, PIM
    eth2, uptime 00:10:15, PIM

(*, 239.1.1.1), uptime 00:20:45, flags: SC
  Incoming interface: eth0, RPF neighbor 10.0.1.1
  Outgoing interface list:
    eth1, uptime 00:20:45, PIM
    eth2, uptime 00:18:30, PIM

IGMP information:

# All IGMP groups
show ip igmp groups

# Groups on a specific interface
show ip igmp interface eth1

# IGMP sources (for IGMPv3/SSM)
show ip igmp sources

# IGMP statistics
show ip igmp statistics

PIM information:

# PIM neighbors
show ip pim neighbor

# PIM interfaces
show ip pim interface

# PIM RP information
show ip pim rp-info

# Upstream state
show ip pim upstream

# BSR information (if used)
show ip pim bsr

# PIM topology for a group
show ip pim join

Static mroute:

# Display static multicast routes
show ip mroute static

# Or via the general command
run show configuration commands | grep "protocols static mroute"

Debugging Commands

Enabling PIM debugging:

# WARNING: generates a lot of logs!
configure
set system syslog global facility all level debug
commit

# View the logs
monitor log messages

Debugging specific components (via vtysh):

# Enter the FRR shell
vtysh

# PIM debugging
debug pim events
debug pim packets
debug pim trace

# IGMP debugging
debug igmp events
debug igmp packets
debug igmp trace

# Multicast forwarding
debug mroute
debug mroute detail

# Disable debugging
no debug pim events
no debug igmp events

# Exit
exit

Checking RPF:

# Check RPF for a specific source
show ip rpf 10.100.50.10

# Output:
# RPF information for 10.100.50.10
#   RPF interface: eth0
#   RPF address: 10.100.1.254
#   RPF metric: 10
#   RPF protocol: Static Mroute

Real-time Monitoring

Watching for changes:

# Monitor the log in real time
monitor log messages

# Track changes in mroute
watch -n 2 'vtysh -c "show ip mroute"'

# Monitor IGMP joins
watch -n 5 'vtysh -c "show ip igmp groups"'

Testing multicast:

# On the sender (source)
# Send multicast packets (requires installing utilities)
# mcast-sender -g 239.1.1.1 -p 5000

# On the receiver
# Join the group
# ip maddr add 239.1.1.1 dev eth0
# mcast-receiver -g 239.1.1.1 -p 5000

# Or use VLC
# vlc udp://@239.1.1.1:5000

Troubleshooting

Common Problems

Problem 1: No multicast traffic

Symptoms:

  • Clients do not receive the multicast stream
  • show ip mroute is empty or lacks the expected entries

Diagnostics:

# Step 1: Check IGMP groups
show ip igmp groups
# You should see groups on the downstream interfaces

# Step 2: Check PIM neighbors
show ip pim neighbor
# There should be neighbors on all PIM interfaces

# Step 3: Check RPF
show ip rpf <source-ip>
# The RPF interface should point to the correct upstream

# Step 4: Check the firewall
show firewall name <rule-set> statistics
# Make sure multicast traffic is not being blocked

# Step 5: Check PIM interfaces
show ip pim interface
# All interfaces should be UP

Solution:

# If there are no IGMP groups - check the IGMP version
configure
set protocols igmp interface eth1 version 3
commit

# If there are no PIM neighbors - check the configuration
show configuration protocols pim
set protocols pim interface eth0
commit

# If RPF is incorrect - add a static mroute
set protocols static mroute <source-network> next-hop <correct-gateway>
commit

# If the firewall is blocking - add rules
set firewall name WAN_IN rule 100 action accept
set firewall name WAN_IN rule 100 protocol pim
set firewall name WAN_IN rule 100 description "Allow PIM protocol"

set firewall name WAN_IN rule 101 action accept
set firewall name WAN_IN rule 101 protocol igmp
set firewall name WAN_IN rule 101 description "Allow IGMP protocol"

set firewall name WAN_IN rule 102 action accept
set firewall name WAN_IN rule 102 destination address 224.0.0.0/4
set firewall name WAN_IN rule 102 description "Allow multicast traffic"
commit
save

Problem 2: RPF failures

Symptoms:

  • In the logs: “RPF failure for (S,G)”
  • show ip mroute shows entries but without outgoing interfaces

Diagnostics:

# Check RPF for the source
show ip rpf <source-ip>

# Check the unicast route to the source
show ip route <source-ip>

# Check the static mroute (if used)
run show configuration commands | grep mroute

Solution:

configure

# Option 1: Add a static mroute
set protocols static mroute <source-network> interface <correct-interface>

# Option 2: Change the metric of an existing route
set protocols static mroute <source-network> next-hop <gateway> distance 5

# Option 3: Use a route-map to change RPF
# (a more complex scenario, usually not required)

commit
save

Problem 3: SSM does not work

Symptoms:

  • IGMPv3 clients cannot join SSM groups
  • No (S,G) entries for the SSM range

Diagnostics:

# Check the IGMP version
show ip igmp interface

# Check the SSM range
run show configuration commands | grep "pim ssm-range"

# Check IGMP sources
show ip igmp sources

Solution:

configure

# Make sure IGMPv3 is enabled
set protocols igmp interface eth1 version 3

# Configure the SSM range
set protocols pim ssm-range 232.0.0.0/8

# Verify that the client uses the correct SSM range
# (232.0.0.0/8 for IPv4)

commit
save

Problem 4: Slow convergence

Symptoms:

  • Long time before multicast reception begins
  • Delays when switching sources

Diagnostics:

# Check the IGMP timers
show ip igmp interface detail

# Check the PIM hello intervals
show ip pim interface detail

Solution:

configure

# Reduce the IGMP query interval
set protocols igmp interface eth1 query-interval 60
set protocols igmp interface eth1 query-max-response-time 50

# Reduce the PIM hello interval
set protocols pim interface eth0 hello-interval 15

# For critical scenarios you can go even lower:
# set protocols igmp interface eth1 query-interval 30
# set protocols pim interface eth0 hello-interval 10

commit
save

Problem 5: Duplicate packets

Symptoms:

  • Clients receive duplicate multicast packets
  • A network loop in the multicast topology

Diagnostics:

# Check the PIM topology
show ip pim neighbor

# Check the DR (Designated Router)
show ip pim interface

# Check for loops
show ip mroute detail
# Look for identical (S,G) on different interfaces with the same uptime

Solution:

configure

# Set the correct DR priority
# Higher priority = preferred DR
set protocols pim interface eth0 dr-priority 100
set protocols pim interface eth1 dr-priority 10

# Verify the RPF is correct
show ip rpf <source-ip>

# If necessary, fix the static mroute
delete protocols static mroute <incorrect-route>
set protocols static mroute <source-network> interface <correct-interface>

commit
save

Advanced Diagnostic Commands

PIM assert mechanism:

# Check the PIM assert state (via vtysh)
vtysh -c "show ip pim assert"

# Check the assert metric
vtysh -c "show ip pim assert-metric"

Multicast VIF (Virtual Interface):

# View multicast virtual interfaces
vtysh -c "show ip multicast vif"

PIM register state:

# Check the registration state on the RP
vtysh -c "show ip pim state"

Best Practices

Network Design

  1. Address space planning:

    • Use 239.0.0.0/8 for private multicast groups
    • Reserve 232.0.0.0/8 for SSM
    • Document group assignments

  2. RP placement:

    • The RP should be at a stable, central point in the network
    • Consider anycast RP for fault tolerance
    • Use different RPs for different group ranges

  3. Topology design:

    • Minimize the number of hops from sources to receivers
    • Avoid asymmetric routing for multicast
    • Use dedicated links for high-bandwidth multicast

Configuration

  1. Use SSM where possible:

    • SSM is simpler and more secure than PIM-SM
    • Does not require RP configuration
    • Optimal routing

  2. Timer tuning:

    • Balance between fast convergence and overhead
    • For critical applications: short intervals
    • For stable networks: standard values

  3. Static mroute:

    • Use only when necessary
    • Document the reason for every static mroute
    • Regularly review their relevance

  4. Firewall rules:

    • Allow the protocols: IGMP (2), PIM (103)
    • Allow multicast addresses (224.0.0.0/4)
    • Use rate limiting to protect against floods

Security

  1. Source control:

    • Restrict which sources may send multicast
    • Use SSM to explicitly specify sources
    • Filter at edge routers

  2. Scope restrictions:

    • Use TTL scoping to limit the reach
    • Administrative boundaries for groups
    • Filtering at domain boundaries

  3. Rate limiting:

    • Limit the bandwidth for multicast
    • Use QoS for prioritization
    • Monitor for anomalous traffic

Example firewall with protection:

configure

# Group of allowed multicast sources
set firewall group network-group MULTICAST_SOURCES network 10.100.0.0/16
set firewall group network-group MULTICAST_SOURCES network 10.200.0.0/16

# Group of allowed multicast addresses
set firewall group network-group MULTICAST_GROUPS network 239.1.0.0/16
set firewall group network-group MULTICAST_GROUPS network 232.0.0.0/8

# Rules on the ingress interface
set firewall name WAN_IN default-action drop

# Allow IGMP
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 protocol igmp
set firewall name WAN_IN rule 10 description "IGMP traffic"

# Allow PIM
set firewall name WAN_IN rule 20 action accept
set firewall name WAN_IN rule 20 protocol pim
set firewall name WAN_IN rule 20 description "PIM protocol"

# Allow multicast from trusted sources
set firewall name WAN_IN rule 100 action accept
set firewall name WAN_IN rule 100 source group network-group MULTICAST_SOURCES
set firewall name WAN_IN rule 100 destination group network-group MULTICAST_GROUPS
set firewall name WAN_IN rule 100 protocol udp
set firewall name WAN_IN rule 100 description "Allowed multicast traffic"

# Rate limit to protect against floods
set firewall name WAN_IN rule 100 limit rate 50/second

# Log dropped multicast (for monitoring)
set firewall name WAN_IN rule 999 action drop
set firewall name WAN_IN rule 999 destination address 224.0.0.0/4
set firewall name WAN_IN rule 999 log enable
set firewall name WAN_IN rule 999 description "Log dropped multicast"

commit
save

Monitoring and Maintenance

  1. Regular checks:

    • Monitor show ip mroute count for anomalies
    • Check PIM neighbors for stability
    • Analyze logs for errors

  2. Baseline metrics:

    • Record the normal number of (S,G) entries
    • The normal number of IGMP groups
    • The usual multicast traffic bandwidth

  3. Alerting:

    • Notifications when PIM neighbors are lost
    • Alerts on sudden changes in mroute count
    • Monitor CPU/memory under heavy multicast load

  4. Documentation:

    • Diagram of the multicast topology
    • RP assignments
    • Distribution of multicast groups across applications
    • Troubleshooting procedures

Performance Optimization

  1. SPT switchover:

    • Tune the switchover threshold to SPT
    • For high-bandwidth sources, use immediate SPT

  2. IGMP snooping:

    • Enable it on switches to optimize L2 flooding
    • Ensure compatibility with IGMPv3

  3. Multicast VPN:

    • For inter-site multicast, consider MVPN
    • Use draft-rosen or next-generation MVPN

  4. Buffer tuning:

    • Increase buffers for high-throughput multicast
    • Configure queue management

Optimization example:

configure

# Immediate switchover to SPT for all groups
# (requires FRR support, check the version)
# set protocols pim spt-switchover infinity-and-beyond immediate

# QoS for multicast (prioritization)
set qos policy shaper MULTICAST_SHAPER bandwidth 500mbit
set qos policy shaper MULTICAST_SHAPER class 10 bandwidth 400mbit
set qos policy shaper MULTICAST_SHAPER class 10 match MCAST destination address 224.0.0.0/4
set qos policy shaper MULTICAST_SHAPER class 10 priority 1
set qos policy shaper MULTICAST_SHAPER class 10 queue-type fair-queue

set interfaces ethernet eth1 qos-policy out MULTICAST_SHAPER

commit
save

Integration with Other Protocols

OSPF and PIM

Multicast RPF uses the unicast routing table. When using OSPF:

configure

# OSPF for unicast
set protocols ospf area 0 network 10.0.0.0/8

# PIM uses OSPF routes for RPF
set protocols pim interface eth0
set protocols pim interface eth1

# RPF will automatically use OSPF routes
commit
save

BGP and Multicast

For inter-AS multicast:

configure

# BGP for unicast connectivity
set protocols bgp system-as 65001
set protocols bgp neighbor 192.168.1.1 remote-as 65002

# MSDP for exchanging sources between ASes (if required)
# Configured via vtysh, as VyOS may not have direct support

# PIM for intra-AS multicast
set protocols pim interface eth0
set protocols pim interface eth1

commit
save

VRF and Multicast

VyOS with FRR supports multicast in a VRF context (in newer versions):

configure

# Create a VRF
set vrf name CUSTOMER-A table 100

# Assign interfaces
set interfaces ethernet eth2 vrf CUSTOMER-A

# Multicast in a VRF context may require configuration via vtysh
# vtysh
# configure terminal
# vrf CUSTOMER-A
#  ip multicast-routing
#  exit
# interface eth2 vrf CUSTOMER-A
#  ip pim
#  ip igmp
#  exit

commit
save

Reference Information

Multicast Addresses

Reserved ranges:

  • 224.0.0.0/24 - local network (not routed)
    • 224.0.0.1 - all hosts on the subnet
    • 224.0.0.2 - all routers
    • 224.0.0.5 - OSPF AllSPFRouters
    • 224.0.0.6 - OSPF AllDRouters
    • 224.0.0.13 - PIM Hello
  • 224.0.1.0/24 - internetwork control
  • 232.0.0.0/8 - Source-Specific Multicast (SSM)
  • 233.0.0.0/8 - GLOP addressing (AS-based)
  • 239.0.0.0/8 - administratively scoped (organizational)

Protocol Numbers

  • IGMP: IP protocol 2
  • PIM: IP protocol 103

Standard Timers

IGMP:

  • Query Interval: 125 seconds
  • Query Response Time: 10 seconds
  • Group Membership Timeout: 260 seconds
  • Last Member Query Count: 2
  • Last Member Query Interval: 1 second

PIM:

  • Hello Interval: 30 seconds
  • Hold Time: 105 seconds (3.5 * Hello)
  • Join/Prune Interval: 60 seconds
  • Register Suppress Time: 60 seconds

Useful Links

RFC documents:

  • RFC 4601 - PIM-SM
  • RFC 3376 - IGMPv3
  • RFC 4607 - SSM
  • RFC 5059 - Bootstrap Router (BSR)
  • RFC 3618 - MSDP
  • RFC 4610 - Anycast-RP using PIM

VyOS documentation:

FRRouting documentation:

Conclusion

Multicast routing in VyOS provides a powerful toolset for efficiently distributing streaming content. Correct configuration of PIM, IGMP, and static multicast routes delivers:

  • Efficient use of bandwidth
  • Scalability for large numbers of receivers
  • Low delivery latency
  • Security through SSM and filtering

Key takeaways:

  1. Use SSM (232.0.0.0/8) where possible for simplicity and security
  2. Apply static mroute only when necessary
  3. Plan RP placement carefully for PIM-SM
  4. Regularly monitor the state of multicast routing
  5. Document the configuration and group assignments

When implemented correctly, VyOS provides a reliable platform for enterprise multicast services in cloud and on-premise environments.

Reviewed by OpenNix LLC · Last updated on
MPLS - Multiprotocol Label SwitchingSegment Routing in VyOS