# Multicast - Multicast Routing

> Multicast Routing in VyOS - deliver streaming video and audio with IGMP and PIM protocols across your network infrastructure

Source: https://opennix.org/en/docs/vyos/routing/vyos-multicast/


## Overview

Multicast Routing enables efficient delivery of data from a single source to many receivers at the same time. This is critically important for streaming applications such as:

- IPTV and streaming video
- Video conferencing
- Software distribution
- Real-time financial data
- Online gaming

VyOS supports multicast routing through integration with FRRouting (FRR), providing full support for the IGMP and PIM protocols.

### Core Concepts

**Multicast Addressing**:
- IPv4 range: 224.0.0.0/4 (224.0.0.0 - 239.255.255.255)
- 224.0.0.0/24 - reserved addresses for the local network
- 239.0.0.0/8 - administratively scoped addresses (for private networks)

**Multicast Groups**:
- Receivers join groups by the group IP address
- Sources send data to the group address
- Routers deliver traffic only to interested receivers

**Protocols**:
- **IGMP (Internet Group Management Protocol)**: manages group membership between hosts and routers
- **PIM (Protocol Independent Multicast)**: routes multicast traffic between routers
- **MSDP (Multicast Source Discovery Protocol)**: exchanges source information between domains

## Multicast Routing Architecture

### Core Components

**Source**:
- A node that sends multicast traffic
- Identified by its IP address

**Group**:
- A set of receivers interested in the data
- Identified by a multicast IP address

**RPF (Reverse Path Forwarding)**:
- A mechanism that verifies a packet arrived over the shortest path toward the source
- Prevents routing loops

**Multicast RIB (MRIB)**:
- A separate routing table for multicast
- Used for RPF checks

### Distribution Tree Types

**SPT (Shortest Path Tree)**:
- The shortest-path tree from the source to receivers
- Optimal latency
- More state on the routers
- Notation: (S,G) - Source, Group

**RPT (Rendezvous Point Tree)**:
- A shared tree through a rendezvous point (RP)
- Less state on the routers
- Possible suboptimal routing
- Notation: (*,G) - Any Source, Group

## Static Multicast Routes

VyOS supports static multicast routes to control RPF checks. These routes are used only to determine the reverse path and do not affect ordinary unicast routing.

### Basic Configuration

**Static route with next-hop**:

```bash
set protocols static mroute <subnet> next-hop <address>
set protocols static mroute <subnet> next-hop <address> distance <distance>
```

Parameters:
- `<subnet>` - network address of the multicast traffic source
- `<address>` - IP address of the next hop for RPF
- `<distance>` - administrative distance (optional, default 1)

**Static route via an interface**:

```bash
set protocols static mroute <subnet> interface <interface>
set protocols static mroute <subnet> interface <interface> distance <distance>
```

Parameters:
- `<interface>` - outgoing interface for the RPF check

**Disabling a route**:

```bash
set protocols static mroute <subnet> next-hop <address> disable
set protocols static mroute <subnet> interface <interface> disable
```

### Configuration Examples

**Example 1: Basic static mroute**

```bash
# Configure a static route for source 10.100.50.0/24
configure
set protocols static mroute 10.100.50.0/24 next-hop 192.168.1.1
commit
save
```

**Example 2: Multiple routes with different metrics**

```bash
configure
# Primary path with a low metric
set protocols static mroute 10.200.0.0/16 next-hop 192.168.1.1 distance 10

# Backup path with a high metric
set protocols static mroute 10.200.0.0/16 next-hop 192.168.2.1 distance 20
commit
save
```

**Example 3: Route via an interface**

```bash
configure
# Multicast traffic from sources in 172.16.0.0/12 is expected on eth1
set protocols static mroute 172.16.0.0/12 interface eth1
commit
save
```

### Important Notes

**Caution**: Static multicast routes should be used with care. In most cases they are not required, because dynamic routing protocols (PIM) handle RPF automatically.

**Limitations**:
- Routes are used only for RPF checks
- Are not inserted into the kernel routing table
- Are not processed by ZEBRA for ordinary routing
- Can create "strange states" if misconfigured

**Use cases**:
- Resolving RPF conflicts in complex topologies
- Overriding unicast routes for multicast traffic
- Supporting asymmetric routing

## Multicast Forwarding (MFIB)

### The Multicast Forwarding Table

MFIB (Multicast Forwarding Information Base) is the data structure used to forward multicast packets.

**Key elements**:
- **(S,G) entries**: an entry for a specific source and group
- **(*,G) entries**: an entry for all sources of a given group
- **IIF (Incoming Interface)**: the interface on which traffic is expected
- **OIL (Outgoing Interface List)**: the list of interfaces used for forwarding

### Interface States

**Incoming Interface (IIF)**:
- Determined by the RPF check
- Only one IIF per (S,G)
- Packets are accepted only from the IIF

**Outgoing Interfaces (OIF)**:
- Interfaces with active receivers
- Managed by IGMP/PIM
- May include tunnels and virtual interfaces

### The Forwarding Process

1. **Packet reception**: verify that the packet arrived through the IIF
2. **RPF check**: if it fails, the packet is dropped
3. **TTL scope**: check the TTL boundary
4. **Forwarding**: copy the packet to every OIF in the list

## IGMP - Internet Group Management Protocol

IGMP manages host membership in multicast groups. VyOS supports IGMPv2 and IGMPv3.

### Main Versions

**IGMPv2**:
- Support for basic join/leave operations
- Querier elections
- Fast leave process

**IGMPv3**:
- Source-Specific Multicast (SSM)
- Source filtering (INCLUDE/EXCLUDE)
- Backward compatibility with IGMPv2

### IGMP Configuration

**Enabling IGMP on an interface**:

```bash
set protocols igmp interface <interface>
```

**Setting the IGMP version**:

```bash
set protocols igmp interface <interface> version <2|3>
```

**Query intervals**:

```bash
# Query interval (seconds, default 125)
set protocols igmp interface <interface> query-interval <seconds>

# Query max-response-time (tenths of a second, default 100)
set protocols igmp interface <interface> query-max-response-time <value>
```

**Join settings**:

```bash
# Static join to a group
set protocols igmp interface <interface> join <group-address>

# Join with a specified source (SSM)
set protocols igmp interface <interface> join <group-address> source <source-address>
```

### IGMP Configuration Example

```bash
configure

# Configure IGMP on the LAN interface
set protocols igmp interface eth1
set protocols igmp interface eth1 version 3
set protocols igmp interface eth1 query-interval 125
set protocols igmp interface eth1 query-max-response-time 100

# Static join (for testing)
set protocols igmp interface eth1 join 239.1.1.1

commit
save
```

## PIM - Protocol Independent Multicast

PIM provides multicast traffic routing between routers. VyOS supports PIM-SM (Sparse Mode) and PIM-SSM (Source-Specific Multicast).

### PIM Operating Modes

**PIM-SM (Sparse Mode)**:
- Uses a Rendezvous Point (RP)
- Efficient for sparsely distributed receivers
- Supports (*,G) and (S,G) trees

**PIM-SSM (Source-Specific Multicast)**:
- Only (S,G) trees
- Does not require an RP
- Address range: 232.0.0.0/8
- Requires IGMPv3

### Basic PIM Configuration

**Enabling PIM**:

```bash
set protocols pim interface <interface>
```

**Configuring the RP (for PIM-SM)**:

```bash
# Static RP
set protocols pim rp address <IP-address>

# RP for specific groups
set protocols pim rp address <IP-address> group <group-address/prefix>
```

**Configuring the SSM range**:

```bash
set protocols pim ssm-range <prefix>
```

**Keep-alive timer**:

```bash
set protocols pim interface <interface> hello-interval <seconds>
set protocols pim interface <interface> dead-interval <seconds>
```

### Advanced PIM Settings

**DR Priority**:

```bash
# Designated Router priority (default 1)
set protocols pim interface <interface> dr-priority <0-4294967295>
```

**Registration with the RP**:

```bash
# Null-register suppression
set protocols pim register-suppress-time <seconds>
```

**BSR (Bootstrap Router)**:

```bash
# Configure the BSR candidate
set protocols pim bsr-candidate interface <interface>
set protocols pim bsr-candidate priority <0-255>
```

### PIM-SM Configuration Example

```bash
configure

# Enable PIM on the interfaces
set protocols pim interface eth0
set protocols pim interface eth1
set protocols pim interface eth2

# Configure hello intervals
set protocols pim interface eth0 hello-interval 30
set protocols pim interface eth1 hello-interval 30
set protocols pim interface eth2 hello-interval 30

# Configure the Rendezvous Point
set protocols pim rp address 10.0.0.1
set protocols pim rp address 10.0.0.1 group 239.0.0.0/8

# Configure DR priority on the upstream interface
set protocols pim interface eth0 dr-priority 100

commit
save
```

### PIM-SSM Configuration Example

```bash
configure

# Enable PIM on the interfaces
set protocols pim interface eth0
set protocols pim interface eth1

# Configure the SSM range
set protocols pim ssm-range 232.0.0.0/8

# IGMP version 3 is mandatory for SSM
set protocols igmp interface eth1 version 3

commit
save
```

## SSM - Source-Specific Multicast

SSM is an enhanced multicast model in which receivers explicitly specify the sources they want to receive data from.

### SSM Advantages

**Security**:
- Receivers select only trusted sources
- Prevents DoS attacks through unknown sources

**Simplicity**:
- Does not require a Rendezvous Point
- Simplified configuration
- Only SPT trees (S,G)

**Efficiency**:
- Optimal paths from source to receivers
- No initial period on the RPT

### SSM Address Ranges

**IPv4**: 232.0.0.0/8
- Standardized by RFC 4607
- Reserved exclusively for SSM

**Example allocation**:
- 232.0.0.0/24 - local tests
- 232.1.0.0/16 - corporate use
- 232.2.0.0/16 - provider services

### SSM Configuration

**Full SSM configuration**:

```bash
configure

# Configure IGMP v3 on the client interfaces
set protocols igmp interface eth1 version 3
set protocols igmp interface eth2 version 3

# Enable PIM
set protocols pim interface eth0
set protocols pim interface eth1
set protocols pim interface eth2

# Define the SSM range
set protocols pim ssm-range 232.0.0.0/8

# Optional: add custom ranges
set protocols pim ssm-range 239.232.0.0/16

commit
save
```

**Static join (SSM)**:

```bash
# A client joins a group with a specific source
set protocols igmp interface eth1 join 232.1.1.1 source 10.100.50.10
```

## Practical Examples

### Example 1: IPTV Distribution in Yandex Cloud

**Scenario**: An IPTV provider in Yandex Cloud distributes television channels to users across different subnets.

**Topology**:
- IPTV source: 10.100.50.10
- Multicast groups: 239.1.1.0/24 (channels)
- VyOS router: edge gateway
- Client networks: 10.200.1.0/24, 10.200.2.0/24

**Configuration**:

```bash
configure

# Interfaces
# eth0 - uplink to the IPTV source
# eth1 - client network 1
# eth2 - client network 2

# Enable IGMP on the client interfaces
set protocols igmp interface eth1 version 3
set protocols igmp interface eth1 query-interval 125
set protocols igmp interface eth1 query-max-response-time 100

set protocols igmp interface eth2 version 3
set protocols igmp interface eth2 query-interval 125
set protocols igmp interface eth2 query-max-response-time 100

# Enable PIM on all interfaces
set protocols pim interface eth0
set protocols pim interface eth1
set protocols pim interface eth2

# Configure hello intervals
set protocols pim interface eth0 hello-interval 30
set protocols pim interface eth1 hello-interval 30
set protocols pim interface eth2 hello-interval 30

# Configure the RP (the router itself)
set protocols pim rp address 10.100.1.1
set protocols pim rp address 10.100.1.1 group 239.1.0.0/16

# Raise DR priority on the uplink
set protocols pim interface eth0 dr-priority 100

# Optimization: static mroute for RPF
set protocols static mroute 10.100.50.0/24 interface eth0

# Configure firewall for multicast (if required)
set firewall group network-group MULTICAST_SOURCES network 10.100.50.0/24
set firewall name WAN_IN rule 100 action accept
set firewall name WAN_IN rule 100 source group network-group MULTICAST_SOURCES
set firewall name WAN_IN rule 100 destination address 239.0.0.0/8
set firewall name WAN_IN rule 100 protocol udp

commit
save
```

**Verification**:

```bash
# Check IGMP groups
show ip igmp groups

# Check PIM neighbors
show ip pim neighbor

# Check multicast routes
show ip mroute

# Check a specific group
show ip mroute 239.1.1.10

# IGMP statistics
show ip igmp interface eth1

# PIM interfaces
show ip pim interface
```

### Example 2: Video Conferencing in VK Cloud

**Scenario**: A corporate video conferencing system uses SSM to distribute video streams between branch offices in VK Cloud.

**Topology**:
- Office A: 192.168.10.0/24
- Office B: 192.168.20.0/24
- Office C: 192.168.30.0/24
- SSM range: 232.10.0.0/16
- VyOS routers in each office

**Configuration (central router)**:

```bash
configure

# Interfaces to the branch offices
# eth1 - Office A (192.168.10.0/24)
# eth2 - Office B (192.168.20.0/24)
# eth3 - Office C (192.168.30.0/24)

# IGMP version 3 is mandatory for SSM
set protocols igmp interface eth1 version 3
set protocols igmp interface eth2 version 3
set protocols igmp interface eth3 version 3

# Short query intervals for fast response
set protocols igmp interface eth1 query-interval 60
set protocols igmp interface eth2 query-interval 60
set protocols igmp interface eth3 query-interval 60

# Enable PIM
set protocols pim interface eth1
set protocols pim interface eth2
set protocols pim interface eth3

# Configure the SSM range
set protocols pim ssm-range 232.0.0.0/8
set protocols pim ssm-range 232.10.0.0/16

# Short hello intervals for fast convergence
set protocols pim interface eth1 hello-interval 15
set protocols pim interface eth2 hello-interval 15
set protocols pim interface eth3 hello-interval 15

# QoS for multicast traffic (optional)
set qos policy shaper OFFICE_OUT bandwidth 100mbit
set qos policy shaper OFFICE_OUT class 10 bandwidth 50mbit
set qos policy shaper OFFICE_OUT class 10 match VIDEO_CONFERENCE ip destination address 232.10.0.0/16
set qos policy shaper OFFICE_OUT class 10 priority 1
set qos policy shaper OFFICE_OUT default bandwidth 50mbit

set interfaces ethernet eth1 qos-policy out OFFICE_OUT
set interfaces ethernet eth2 qos-policy out OFFICE_OUT
set interfaces ethernet eth3 qos-policy out OFFICE_OUT

commit
save
```

**Client configuration (for testing)**:

On a Linux client, to join an SSM group:

```bash
# Utility for the SSM join
ip maddr add 232.10.1.1 dev eth0

# Or with a specified source (IGMPv3)
# Requires a special application that supports SSM
# For example, VLC with the parameters:
vlc udp://@232.10.1.1:5000 --miface=eth0 --program-ssrc=192.168.10.100
```

**Verifying SSM**:

```bash
# Check (S,G) entries
show ip mroute

# You should see entries such as:
# (192.168.10.100, 232.10.1.1)
# (192.168.20.50, 232.10.1.2)

# Check IGMP groups with sources
show ip igmp groups

# PIM upstream state
show ip pim upstream

# Statistics for the group
show ip mroute 232.10.1.1
```

### Example 3: Comprehensive Configuration with Multiple RPs

**Scenario**: A large network with multicast domain separation and RP redundancy.

```bash
configure

# ========================================
# Basic interface settings
# ========================================

# Upstream interfaces
set protocols igmp interface eth0
set protocols igmp interface eth0 version 3
set protocols pim interface eth0
set protocols pim interface eth0 dr-priority 100

# Downstream interfaces
set protocols igmp interface eth1 version 3
set protocols igmp interface eth2 version 3
set protocols igmp interface eth3 version 3

set protocols pim interface eth1
set protocols pim interface eth2
set protocols pim interface eth3

# ========================================
# Configuring multiple RPs
# ========================================

# Primary RP for general groups
set protocols pim rp address 10.0.1.1
set protocols pim rp address 10.0.1.1 group 239.0.0.0/16

# Dedicated RP for video (239.1.x.x)
set protocols pim rp address 10.0.2.1
set protocols pim rp address 10.0.2.1 group 239.1.0.0/16

# RP for audio (239.2.x.x)
set protocols pim rp address 10.0.3.1
set protocols pim rp address 10.0.3.1 group 239.2.0.0/16

# SSM range (no RP)
set protocols pim ssm-range 232.0.0.0/8

# ========================================
# Static mroute for RPF control
# ========================================

# Video sources
set protocols static mroute 10.100.0.0/16 next-hop 10.0.1.254 distance 10

# Backup path
set protocols static mroute 10.100.0.0/16 next-hop 10.0.2.254 distance 20

# ========================================
# Timer optimization
# ========================================

# Fast convergence on critical interfaces
set protocols pim interface eth0 hello-interval 15
set protocols pim interface eth1 hello-interval 30
set protocols pim interface eth2 hello-interval 30
set protocols pim interface eth3 hello-interval 30

# IGMP query optimization
set protocols igmp interface eth1 query-interval 60
set protocols igmp interface eth2 query-interval 60
set protocols igmp interface eth3 query-interval 60

# ========================================
# Logging and debugging
# ========================================

# Enable PIM logs (optional, for debugging)
# set protocols pim log-neighbor-changes

commit
save
```

## Verification and Monitoring Commands

### Basic show Commands

**Multicast routing table**:

```bash
# Full multicast routing table
show ip mroute

# A specific group
show ip mroute 239.1.1.1

# Active sources only
show ip mroute active

# Detailed information
show ip mroute detail

# Statistics
show ip mroute count
```

**show ip mroute output**:

```
IP Multicast Routing Table
Flags: S - Sparse, C - Connected, P - Pruned
       R - RP-bit set, F - Register flag, T - SPT-bit set

(10.100.50.10, 239.1.1.1), uptime 00:15:23, flags: SCT
  Incoming interface: eth0, RPF neighbor 10.100.1.254
  Outgoing interface list:
    eth1, uptime 00:15:23, PIM
    eth2, uptime 00:10:15, PIM

(*, 239.1.1.1), uptime 00:20:45, flags: SC
  Incoming interface: eth0, RPF neighbor 10.0.1.1
  Outgoing interface list:
    eth1, uptime 00:20:45, PIM
    eth2, uptime 00:18:30, PIM
```

**IGMP information**:

```bash
# All IGMP groups
show ip igmp groups

# Groups on a specific interface
show ip igmp interface eth1

# IGMP sources (for IGMPv3/SSM)
show ip igmp sources

# IGMP statistics
show ip igmp statistics
```

**PIM information**:

```bash
# PIM neighbors
show ip pim neighbor

# PIM interfaces
show ip pim interface

# PIM RP information
show ip pim rp-info

# Upstream state
show ip pim upstream

# BSR information (if used)
show ip pim bsr

# PIM topology for a group
show ip pim join
```

**Static mroute**:

```bash
# Display static multicast routes
show ip mroute static

# Or via the general command
run show configuration commands | grep "protocols static mroute"
```

### Debugging Commands

**Enabling PIM debugging**:

```bash
# WARNING: generates a lot of logs!
configure
set system syslog global facility all level debug
commit

# View the logs
monitor log messages
```

**Debugging specific components** (via vtysh):

```bash
# Enter the FRR shell
vtysh

# PIM debugging
debug pim events
debug pim packets
debug pim trace

# IGMP debugging
debug igmp events
debug igmp packets
debug igmp trace

# Multicast forwarding
debug mroute
debug mroute detail

# Disable debugging
no debug pim events
no debug igmp events

# Exit
exit
```

**Checking RPF**:

```bash
# Check RPF for a specific source
show ip rpf 10.100.50.10

# Output:
# RPF information for 10.100.50.10
#   RPF interface: eth0
#   RPF address: 10.100.1.254
#   RPF metric: 10
#   RPF protocol: Static Mroute
```

### Real-time Monitoring

**Watching for changes**:

```bash
# Monitor the log in real time
monitor log messages

# Track changes in mroute
watch -n 2 'vtysh -c "show ip mroute"'

# Monitor IGMP joins
watch -n 5 'vtysh -c "show ip igmp groups"'
```

**Testing multicast**:

```bash
# On the sender (source)
# Send multicast packets (requires installing utilities)
# mcast-sender -g 239.1.1.1 -p 5000

# On the receiver
# Join the group
# ip maddr add 239.1.1.1 dev eth0
# mcast-receiver -g 239.1.1.1 -p 5000

# Or use VLC
# vlc udp://@239.1.1.1:5000
```

## Troubleshooting

### Common Problems

#### Problem 1: No multicast traffic

**Symptoms**:
- Clients do not receive the multicast stream
- `show ip mroute` is empty or lacks the expected entries

**Diagnostics**:

```bash
# Step 1: Check IGMP groups
show ip igmp groups
# You should see groups on the downstream interfaces

# Step 2: Check PIM neighbors
show ip pim neighbor
# There should be neighbors on all PIM interfaces

# Step 3: Check RPF
show ip rpf <source-ip>
# The RPF interface should point to the correct upstream

# Step 4: Check the firewall
show firewall name <rule-set> statistics
# Make sure multicast traffic is not being blocked

# Step 5: Check PIM interfaces
show ip pim interface
# All interfaces should be UP
```

**Solution**:

```bash
# If there are no IGMP groups - check the IGMP version
configure
set protocols igmp interface eth1 version 3
commit

# If there are no PIM neighbors - check the configuration
show configuration protocols pim
set protocols pim interface eth0
commit

# If RPF is incorrect - add a static mroute
set protocols static mroute <source-network> next-hop <correct-gateway>
commit

# If the firewall is blocking - add rules
set firewall name WAN_IN rule 100 action accept
set firewall name WAN_IN rule 100 protocol pim
set firewall name WAN_IN rule 100 description "Allow PIM protocol"

set firewall name WAN_IN rule 101 action accept
set firewall name WAN_IN rule 101 protocol igmp
set firewall name WAN_IN rule 101 description "Allow IGMP protocol"

set firewall name WAN_IN rule 102 action accept
set firewall name WAN_IN rule 102 destination address 224.0.0.0/4
set firewall name WAN_IN rule 102 description "Allow multicast traffic"
commit
save
```

#### Problem 2: RPF failures

**Symptoms**:
- In the logs: "RPF failure for (S,G)"
- `show ip mroute` shows entries but without outgoing interfaces

**Diagnostics**:

```bash
# Check RPF for the source
show ip rpf <source-ip>

# Check the unicast route to the source
show ip route <source-ip>

# Check the static mroute (if used)
run show configuration commands | grep mroute
```

**Solution**:

```bash
configure

# Option 1: Add a static mroute
set protocols static mroute <source-network> interface <correct-interface>

# Option 2: Change the metric of an existing route
set protocols static mroute <source-network> next-hop <gateway> distance 5

# Option 3: Use a route-map to change RPF
# (a more complex scenario, usually not required)

commit
save
```

#### Problem 3: SSM does not work

**Symptoms**:
- IGMPv3 clients cannot join SSM groups
- No (S,G) entries for the SSM range

**Diagnostics**:

```bash
# Check the IGMP version
show ip igmp interface

# Check the SSM range
run show configuration commands | grep "pim ssm-range"

# Check IGMP sources
show ip igmp sources
```

**Solution**:

```bash
configure

# Make sure IGMPv3 is enabled
set protocols igmp interface eth1 version 3

# Configure the SSM range
set protocols pim ssm-range 232.0.0.0/8

# Verify that the client uses the correct SSM range
# (232.0.0.0/8 for IPv4)

commit
save
```

#### Problem 4: Slow convergence

**Symptoms**:
- Long time before multicast reception begins
- Delays when switching sources

**Diagnostics**:

```bash
# Check the IGMP timers
show ip igmp interface detail

# Check the PIM hello intervals
show ip pim interface detail
```

**Solution**:

```bash
configure

# Reduce the IGMP query interval
set protocols igmp interface eth1 query-interval 60
set protocols igmp interface eth1 query-max-response-time 50

# Reduce the PIM hello interval
set protocols pim interface eth0 hello-interval 15

# For critical scenarios you can go even lower:
# set protocols igmp interface eth1 query-interval 30
# set protocols pim interface eth0 hello-interval 10

commit
save
```

#### Problem 5: Duplicate packets

**Symptoms**:
- Clients receive duplicate multicast packets
- A network loop in the multicast topology

**Diagnostics**:

```bash
# Check the PIM topology
show ip pim neighbor

# Check the DR (Designated Router)
show ip pim interface

# Check for loops
show ip mroute detail
# Look for identical (S,G) on different interfaces with the same uptime
```

**Solution**:

```bash
configure

# Set the correct DR priority
# Higher priority = preferred DR
set protocols pim interface eth0 dr-priority 100
set protocols pim interface eth1 dr-priority 10

# Verify the RPF is correct
show ip rpf <source-ip>

# If necessary, fix the static mroute
delete protocols static mroute <incorrect-route>
set protocols static mroute <source-network> interface <correct-interface>

commit
save
```

### Advanced Diagnostic Commands

**PIM assert mechanism**:

```bash
# Check the PIM assert state (via vtysh)
vtysh -c "show ip pim assert"

# Check the assert metric
vtysh -c "show ip pim assert-metric"
```

**Multicast VIF (Virtual Interface)**:

```bash
# View multicast virtual interfaces
vtysh -c "show ip multicast vif"
```

**PIM register state**:

```bash
# Check the registration state on the RP
vtysh -c "show ip pim state"
```

## Best Practices

### Network Design

1. **Address space planning**:
   - Use 239.0.0.0/8 for private multicast groups
   - Reserve 232.0.0.0/8 for SSM
   - Document group assignments

2. **RP placement**:
   - The RP should be at a stable, central point in the network
   - Consider anycast RP for fault tolerance
   - Use different RPs for different group ranges

3. **Topology design**:
   - Minimize the number of hops from sources to receivers
   - Avoid asymmetric routing for multicast
   - Use dedicated links for high-bandwidth multicast

### Configuration

1. **Use SSM where possible**:
   - SSM is simpler and more secure than PIM-SM
   - Does not require RP configuration
   - Optimal routing

2. **Timer tuning**:
   - Balance between fast convergence and overhead
   - For critical applications: short intervals
   - For stable networks: standard values

3. **Static mroute**:
   - Use only when necessary
   - Document the reason for every static mroute
   - Regularly review their relevance

4. **Firewall rules**:
   - Allow the protocols: IGMP (2), PIM (103)
   - Allow multicast addresses (224.0.0.0/4)
   - Use rate limiting to protect against floods

### Security

1. **Source control**:
   - Restrict which sources may send multicast
   - Use SSM to explicitly specify sources
   - Filter at edge routers

2. **Scope restrictions**:
   - Use TTL scoping to limit the reach
   - Administrative boundaries for groups
   - Filtering at domain boundaries

3. **Rate limiting**:
   - Limit the bandwidth for multicast
   - Use QoS for prioritization
   - Monitor for anomalous traffic

**Example firewall with protection**:

```bash
configure

# Group of allowed multicast sources
set firewall group network-group MULTICAST_SOURCES network 10.100.0.0/16
set firewall group network-group MULTICAST_SOURCES network 10.200.0.0/16

# Group of allowed multicast addresses
set firewall group network-group MULTICAST_GROUPS network 239.1.0.0/16
set firewall group network-group MULTICAST_GROUPS network 232.0.0.0/8

# Rules on the ingress interface
set firewall name WAN_IN default-action drop

# Allow IGMP
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 protocol igmp
set firewall name WAN_IN rule 10 description "IGMP traffic"

# Allow PIM
set firewall name WAN_IN rule 20 action accept
set firewall name WAN_IN rule 20 protocol pim
set firewall name WAN_IN rule 20 description "PIM protocol"

# Allow multicast from trusted sources
set firewall name WAN_IN rule 100 action accept
set firewall name WAN_IN rule 100 source group network-group MULTICAST_SOURCES
set firewall name WAN_IN rule 100 destination group network-group MULTICAST_GROUPS
set firewall name WAN_IN rule 100 protocol udp
set firewall name WAN_IN rule 100 description "Allowed multicast traffic"

# Rate limit to protect against floods
set firewall name WAN_IN rule 100 limit rate 50/second

# Log dropped multicast (for monitoring)
set firewall name WAN_IN rule 999 action drop
set firewall name WAN_IN rule 999 destination address 224.0.0.0/4
set firewall name WAN_IN rule 999 log enable
set firewall name WAN_IN rule 999 description "Log dropped multicast"

commit
save
```

### Monitoring and Maintenance

1. **Regular checks**:
   - Monitor `show ip mroute count` for anomalies
   - Check PIM neighbors for stability
   - Analyze logs for errors

2. **Baseline metrics**:
   - Record the normal number of (S,G) entries
   - The normal number of IGMP groups
   - The usual multicast traffic bandwidth

3. **Alerting**:
   - Notifications when PIM neighbors are lost
   - Alerts on sudden changes in mroute count
   - Monitor CPU/memory under heavy multicast load

4. **Documentation**:
   - Diagram of the multicast topology
   - RP assignments
   - Distribution of multicast groups across applications
   - Troubleshooting procedures

### Performance Optimization

1. **SPT switchover**:
   - Tune the switchover threshold to SPT
   - For high-bandwidth sources, use immediate SPT

2. **IGMP snooping**:
   - Enable it on switches to optimize L2 flooding
   - Ensure compatibility with IGMPv3

3. **Multicast VPN**:
   - For inter-site multicast, consider MVPN
   - Use draft-rosen or next-generation MVPN

4. **Buffer tuning**:
   - Increase buffers for high-throughput multicast
   - Configure queue management

**Optimization example**:

```bash
configure

# Immediate switchover to SPT for all groups
# (requires FRR support, check the version)
# set protocols pim spt-switchover infinity-and-beyond immediate

# QoS for multicast (prioritization)
set qos policy shaper MULTICAST_SHAPER bandwidth 500mbit
set qos policy shaper MULTICAST_SHAPER class 10 bandwidth 400mbit
set qos policy shaper MULTICAST_SHAPER class 10 match MCAST destination address 224.0.0.0/4
set qos policy shaper MULTICAST_SHAPER class 10 priority 1
set qos policy shaper MULTICAST_SHAPER class 10 queue-type fair-queue

set interfaces ethernet eth1 qos-policy out MULTICAST_SHAPER

commit
save
```

## Integration with Other Protocols

### OSPF and PIM

Multicast RPF uses the unicast routing table. When using OSPF:

```bash
configure

# OSPF for unicast
set protocols ospf area 0 network 10.0.0.0/8

# PIM uses OSPF routes for RPF
set protocols pim interface eth0
set protocols pim interface eth1

# RPF will automatically use OSPF routes
commit
save
```

### BGP and Multicast

For inter-AS multicast:

```bash
configure

# BGP for unicast connectivity
set protocols bgp system-as 65001
set protocols bgp neighbor 192.168.1.1 remote-as 65002

# MSDP for exchanging sources between ASes (if required)
# Configured via vtysh, as VyOS may not have direct support

# PIM for intra-AS multicast
set protocols pim interface eth0
set protocols pim interface eth1

commit
save
```

### VRF and Multicast

VyOS with FRR supports multicast in a VRF context (in newer versions):

```bash
configure

# Create a VRF
set vrf name CUSTOMER-A table 100

# Assign interfaces
set interfaces ethernet eth2 vrf CUSTOMER-A

# Multicast in a VRF context may require configuration via vtysh
# vtysh
# configure terminal
# vrf CUSTOMER-A
#  ip multicast-routing
#  exit
# interface eth2 vrf CUSTOMER-A
#  ip pim
#  ip igmp
#  exit

commit
save
```

## Reference Information

### Multicast Addresses

**Reserved ranges**:
- 224.0.0.0/24 - local network (not routed)
  - 224.0.0.1 - all hosts on the subnet
  - 224.0.0.2 - all routers
  - 224.0.0.5 - OSPF AllSPFRouters
  - 224.0.0.6 - OSPF AllDRouters
  - 224.0.0.13 - PIM Hello
- 224.0.1.0/24 - internetwork control
- 232.0.0.0/8 - Source-Specific Multicast (SSM)
- 233.0.0.0/8 - GLOP addressing (AS-based)
- 239.0.0.0/8 - administratively scoped (organizational)

### Protocol Numbers

- **IGMP**: IP protocol 2
- **PIM**: IP protocol 103

### Standard Timers

**IGMP**:
- Query Interval: 125 seconds
- Query Response Time: 10 seconds
- Group Membership Timeout: 260 seconds
- Last Member Query Count: 2
- Last Member Query Interval: 1 second

**PIM**:
- Hello Interval: 30 seconds
- Hold Time: 105 seconds (3.5 * Hello)
- Join/Prune Interval: 60 seconds
- Register Suppress Time: 60 seconds

### Useful Links

**RFC documents**:
- RFC 4601 - PIM-SM
- RFC 3376 - IGMPv3
- RFC 4607 - SSM
- RFC 5059 - Bootstrap Router (BSR)
- RFC 3618 - MSDP
- RFC 4610 - Anycast-RP using PIM

**VyOS documentation**:
- https://docs.vyos.io/en/latest/configuration/protocols/multicast.html
- https://docs.vyos.io/en/latest/configuration/protocols/pim.html
- https://docs.vyos.io/en/latest/configuration/protocols/igmp.html

**FRRouting documentation**:
- https://docs.frrouting.org/en/latest/pim.html
- https://docs.frrouting.org/en/latest/multicast.html

## Conclusion

Multicast routing in VyOS provides a powerful toolset for efficiently distributing streaming content. Correct configuration of PIM, IGMP, and static multicast routes delivers:

- Efficient use of bandwidth
- Scalability for large numbers of receivers
- Low delivery latency
- Security through SSM and filtering

**Key takeaways**:
1. Use SSM (232.0.0.0/8) where possible for simplicity and security
2. Apply static mroute only when necessary
3. Plan RP placement carefully for PIM-SM
4. Regularly monitor the state of multicast routing
5. Document the configuration and group assignments

When implemented correctly, VyOS provides a reliable platform for enterprise multicast services in cloud and on-premise environments.