IGMP snooping

The FortiSwitch unit uses the information passed in IGMP messages to optimize the forwarding of IPv4 multicast traffic.

IGMP snooping allows the FortiSwitch unit to passively listen to the Internet Group Management Protocol (IGMP) network traffic between hosts and routers. The switch uses this information to determine which ports are interested in receiving each multicast feed. The FortiSwitch unit can reduce unnecessary multicast traffic on the LAN by pruning multicast traffic from links that do not contain a multicast listener.

Essentially, IGMP snooping is a layer-2 optimization for the layer-3 IGMP.

The current version of IGMP is version 3, and the FortiSwitch unit is also compatible with IGMPv1 and IGMPv2.

Starting in FortiSwitchOS 6.4.3, you can configure the IGMP-snooping querier version 2 or 3. When the IGMP querier version 2 is configured, the FortiSwitch unit will send IGMP queries version 2 when no external querier is present. When the IGMP querier version 3 is configured, the FortiSwitch unit will send IGMP queries version 3 when no external querier is present. The default IGMP querier version is 2.

Here is the basic IGMP snooping operation:

1. A host expresses interest in joining a multicast group. (Sends or responds to a join message).
2. The FortiSwitch unit creates an entry in the layer-2 forwarding table (or adds the hostʼs port to an existing entry). The switch creates one table entry per VLAN per multicast group.
3. The FortiSwitch unit removes the entry when the last host leaves the group (or when the entry ages out).

In addition, you can configure the FortiSwitch unit to send periodic queries from all ports in a specific VLAN to request IGMP reports. The FortiSwitch unit uses the IGMP reports to update the layer-2 forwarding table.

NOTE: If you want to use IGMP snooping with an MCLAG, see Configuring an MCLAG with IGMP snooping.

This chapter covers the following topics:

• Notes
• Configuring IGMP snooping
• Configuring the IGMP querier
• Configuring mRouter ports

Notes

• To make well-known multicast packets, such as mDNS, flood to all ports when IGMP snooping is enabled on FSR-112D-POE, you need to make the following configuration change.

  In 6.2.x through 6.4.2 GA:

  config switch igmp-snooping globals

  set flood-unknown-multicast

  end

  In 6.4.3 GA and later:

  config switch global

  set flood-unknown-multicast enable

  end

• On the FS-100E series, IGMP snooping can be enabled on a maximum of 6 VLANs.
• Enabling the set flood-unknown-multicast command and then disabling it disrupts the forwarding of unknown multicast traffic to mRouter ports for a short period, depending on the query interval, because the mRouter ports need to be relearned.
• The IGMP groupʼs source address(es) in the IGMPv3 report are not considered.
• The IGMP snooping entries are added based on multicast group MAC addresses.
• When IGMP snooping is enabled on a VLAN on the FSR-112D-POE model:
  • All IPv6 multicast and any non-IP multicast are forwarded to querier ports only instead of getting flooded on the VLAN. The forwarding of IPv6 to the CPU is unchanged.
  • IPv4 reserved multicast is flooded to the VLAN and not forwarded to the CPU, even if the CPU is part of the VLAN.
  • Unregistered IPv4 multicast is forwarded to querier ports only.

  If IPv6 multicast and/or non-IP multicast is expected to be forwarded to any ports other than querier ports, the mcast-snooping-flood-traffic setting can be enabled on the required ports.

• Starting with FortiSwitchOS 6.4.0, when an inter-switch link (ISL) is formed automatically, the igmp-snooping-flood-reports and mcast-snooping-flood-traffic options are disabled by default.
• Proxy reporting is not supported for IGMPv3.
• Explicit host tracking is not supported.
• Immediate leave for IGMPv3 is not supported.
• IGMP snooping and MLD snooping share the same lookup table. Starting with FortiSwitchOS 6.4.5, the following snooping table limits apply:
  
  

  FortiSwitch Models	Snooping Table Limit
  FSR-112D-POE	4,096
  FSR-124D, FS-2xxD, FS-2xxE, FS-4xxD, FS-4xxE, FS-M426E-FPOE	1,024
  FS-124E, FS-124F, and FS-108E	1,024
  FS-148E and FS-148F	4,096
  FS-5xx	8,192 (IGMP snooping) and 6,144 (MLD snooping)
  FS-1048E	8,192
  FS-1048D and FS-1024D	4,096
  FS-3032D and FS-3032E	8,192

  Until FortiSwitchOS 3.5.1, the table limits were hardware only. The software limit for all platforms was 8192.

• When the IGMP proxy is enabled, the proxy report and proxy leave use the IP address 0.0.0.0. IGMP group-specific queries sent by the proxy use the internal querierʼs IP address if it is configured.

Configuring IGMP snooping

Configuring IGMP snooping consists of the following major steps:

1. Configure IGMP snooping on a global level.
2. Optional. Enable IGMP-snooping options on the interfaces.
3. Configure IGMP snooping on the VLANs.

1. Configure IGMP snooping on a global level

By default, the maximum time (aging-time) that multicast snooping entries without any packets are kept is for 300 seconds. This value can be in the range of 15-3,600 seconds. By default, flood-unknown-multicast is disabled, and unregistered multicast packets are forwarded only to mRouter ports. If you enable flood-unknown-multicast, unregistered multicast packets are forwarded to all ports in the VLAN.

Using the CLI:

config switch igmp-snooping globals

set aging-time <15-3600>

end

config switch global

set flood-unknown-multicast {enable | disable}

end

For example:

config switch igmp-snooping globals

set aging-time 500

end

config switch global

set flood-unknown-multicast enable

end

2. Enable IGMP-snooping options on the interfaces

Optional. You can flood IGMP reports and flood multicast traffic on a specified switch interface. By default, these options are disabled.

Using the GUI:

1. Go to Switch > Interface > Physical or Switch > Interface > Trunk.
2. Select an interface.
3. Select Edit.
4. In the IGMP Snooping area, select Flood Reports, Flood Traffic, or both if needed.
5. Select OK.

Using the CLI:

config switch interface

edit <port>

set native-vlan <vlan-id>

set igmp-snooping-flood-reports {enable | disable}

set mcast-snooping-flood-traffic {enable | disable}

next

end

For example:

config switch interface

edit port10

set native-vlan 30

set igmp-snooping-flood-reports enable

set mcast-snooping-flood-traffic enable

next

edit port2

set native-vlan 30

set igmp-snooping-flood-reports enable

set mcast-snooping-flood-traffic enable

next

edit port4

set native-vlan 30

set igmp-snooping-flood-reports enable

set mcast-snooping-flood-traffic enable

next

edit port6

set native-vlan 30

set igmp-snooping-flood-reports enable

set mcast-snooping-flood-traffic enable

next

edit port8

set native-vlan 30

set igmp-snooping-flood-reports enable

set mcast-snooping-flood-traffic enable

next

end

Use the following command to clear the learned/configured multicast group from an interface:

execute clear switch igmp-snooping

3. Configure IGMP snooping on the VLANs

Enable IGMP snooping on a specified VLAN and configure IGMP static groups. By default, IGMP snooping is disabled.

You can define static groups for particular multicast addresses in a VLAN that has IGMP snooping enabled. You can specify multiple ports in the static group, separated by a space. The trunk interface can also be included in a static group. There are two restrictions for IGMP static groups:

• The range of multicast addresses (mcast-addr) from 224.0.0.1 to 224.0.0.255 cannot be used.
• The VLAN must already be assigned as the native VLAN for a switch interface and be included in the range of allowed VLANs for a switch interface. You can check the Physical Port Interfaces page to see which VLANs can be used for IGMP static groups.

Starting in FortiSwitchOS 6.2.0, you can also use the CLI to enable IGMP proxy, which allows the VLAN to send IGMP reports. After you enable igmp-snooping-proxy on a VLAN, it will start suppressing reports and leave messages. For each multicast group, only one report is sent to the upstream interface. When a leave message is received, the FortiSwitch unit will only send the leave message to the upstream interface when there are no more members left in the multicast group. The FortiSwitch unit will also reply to generic queries and will send IGMP reports to the upstream interface.

Using the GUI:

1. Go to Switch > VLAN.
2. Select Add VLAN.
3. In the ID field, enter the VLAN identifier.
4. In the Description field, enter a description for the new VLAN.
5. In the IGMP Snooping area, select Enable.
6. Optionally, select IGMP Proxy.
7. In the IGMP Static Groups area, select + to add an IGMP static group.
   NOTE: If the VLAN identifier that you entered in step 3 is not already assigned as the native VLAN for an interface and is not included in the range of allowed VLANs for an interface, the + button does not work.
8. In the Name field, enter a name for the IGMP static group.
9. In the Multicast Address field, enter the multicast address.
10. Select the interfaces to include.
11. Select Add to create the new VLAN.

Using the CLI:

config switch vlan

edit <vlan-id>

set igmp-snooping {enable |disable}

set igmp-snooping-proxy {enable | disable}

set igmp-snooping-fast-leave {enable | disable}

config igmp-snooping-static-group

edit <group-name>

set mcast-addr <IPv4_multicast_address>

set members <interface_name1> <interface_name2>...

next

end

next

end

For example, to configure two static groups for the same VLAN:

config switch vlan

edit 30

set igmp-snooping enable

config igmp-snooping-static-group

edit g239-1-1-1

set mcast-addr 239.1.1.1

set members port2 port5 port28

next

edit g239-2-2-2

set mcast-addr 239.2.2.2

set members port5 port10 trunk-1

next

end

next

end

Check the IGMP-snooping configuration

Use the following commands to display information about IGMP snooping:

# get switch igmp-snooping {globals | group | static-group | status}

• globals: display the IGMP-snooping global configuration on the FortiSwitch unit
• group: display a list of learned multicast groups
• static-group: display the list of configured static groups
• status: display the status of IGMP-snooping VLANs and group

Go to Switch > Monitor > IGMP Snooping to see the learned multicast groups:

Use the following CLI command to see the learned multicast groups:

FS1D243Z13000023 # get switch igmp-snooping group

Number of Groups: 7

port of-port VLAN GROUP Age

(__port__9) 1 23 231.8.5.4 16

(__port__9) 1 23 231.8.5.5 16

(__port__9) 1 23 231.8.5.6 16

(__port__9) 1 23 231.8.5.7 16

(__port__9) 1 23 231.8.5.8 16

(__port__9) 1 23 231.8.5.9 16

(__port__9) 1 23 231.8.5.10 16

(__port__43) 3 23 querier 17

(__port__14) 8 --- flood-reports ---

(__port__10) 2 --- flood-traffic ---

Display the list of configured static groups:

FS1D243Z13000023 # get switch igmp-snooping static-group

VLAN ID Group-Name Multicast-addr Member-interface

_______ ______________ _______________ _________________________

11 g239-1 239:1:1:1 port6 trunk-2

11 g239-11 239:2:2:11 port26 port48 trunk-2

40 g239-1 239:1:1:1 port5 port25 trunk-2

40 g239-2 239:2:2:2 port25 port26

Configuring the IGMP querier

To use the IGMP querier, you need to configure how often IGMP queries are sent and enable the IGMP querier for a specific VLAN. Optionally, you can specify the address for the IGMP querier.

Use the following commands to specify how many seconds are between IGMP queries. The default is 120 seconds.

config switch igmp-snooping globals

set query-interval <10-1200>

end

For example:

config switch igmp-snooping globals

set aging-time 150

set query-interval 200

end

Use the following commands to enable the IGMP querier for a specific VLAN and specify the address that IGMP reports are sent to:

config switch vlan

edit 100

set igmp-snooping {enable | disable}

set igmp-snooping-querier {enable | disable}

set igmp-snooping-querier-addr <IPv4_address>

set igmp-snooping-querier-version {2 | 3}

next

end

For example:

config switch vlan

edit 100

set igmp-snooping enable

set igmp-snooping-querier enable

set igmp-snooping-querier-addr 1.2.3.4

set igmp-snooping-querier-version 3

next

end

Configuring mRouter ports

Use the following commands to configure a FortiSwitch port as an mRouter port:

NOTE: These settings are not per-VLAN, so the port will act as a querier/mRouter port for all of its associated VLANs.

config switch interface

edit <port>

set igmp-snooping-flood-reports enable

set mcast-snooping-flood-traffic enable

next

end