Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 136 / 861

136 Establishing your network
Allowing multicast traffic
How the security gateway handles multicast traffic
In Figure 5-8 , the security gateway protects two networks that it connects to through network
interfaces eth0 and eth2. Hosts 1, 2, and 3 are multicast hosts. If you decide that you want only the
three hosts to communicate with each other, you need to enable multicast support on the network
interfaces eth0 and eth2. If you also want to allow multicast packets from outside the protected
network, you would also enable multicast support on eth1.
Figure 5-8 Passing multicast traffic through interfaces
Note: When an appliance has multiple interfaces connected to one network, only one interface should
forward multicast traffic.
Configuring the security gateway to allow multicast traffic
Before you configure multicasting, note the following:
■
Multicast support is disabled by default. Multicast traffic may offer some risk to security, as
multicast traffic is not subject to rule checking, antivirus, and content scanning. It is recommended
that multicast only be enabled on inside interfaces, or through a gateway-to-gateway IPsec tunnel
if using an outside interface.
■
Multicast traffic does not pass through client-to-gateway tunnels.
■
The appliance supports IGMP and multicast with a third-party router running IGMP version 2 on
the same physical network. The security gateway does not support advanced multicast routing
protocols such as Distance Vector Multicast Routing Protocol (DVMRP) and multicast-enhanced
OSPF.
■
The security gateway does not support multicast in a cluster environment.
Prerequisites
None.
Configure the security gateway to allow multicast traffic
To configure the security gateway to allow multicast traffic, you must do the following:
■
Enable multicast support
■
Configure the security gateway and each interface to support multicast
eth1
eth2
eth0
Host 1
Host 2
Host 3