This article will show you how to route traffic using a VPN tunnel, which is a popular scenario that is commonly used to work and communicate in a protected environment on the internet. Video streaming (IPTV) is another frequently used application. Furthermore, this article will show you how to configure the VPN tunnel using VTI interface and what policy route to create.
In some circumstances, users may want to forward their video stream from site to site through the VPN tunnel. IGMP over IPSec is required in this kind of application.
Users can follow this procedure to set up a VPN tunnel and IGMP proxy to fulfill a certain purpose.
Table of Content
1) Set Up IPSec VPN tunnel and VTI interface on both USGs
2) Set Up the IGMP proxy function on both of USG
3) Add policy route on both USG to allow IGMP traffic to the remote site
4) Verification
Scenario and Topology
The topology and the setup steps are shown below.
- A public IP address on the USG
1) Set Up IPSec VPN tunnel and VTI interface
On USG#1 go to
Configuration > VPN > IPSec VPN > VPN Gateway
click add to create a VPN gateway rule.
Go to
Configuration > VPN > IPSec VPN > VPN Connection
click add to create a VPN connection rule.
Go to
Configuration > Network > Interface > VTI
then click the Add button to create a VTI interface.
On USG#2 go to
Configuration > VPN > IPSec VPN > VPN Gateway
Click the Add Button to create a VPN gateway rule.
Go to
Configuration > VPN > IPSec VPN > VPN Connection
Click the Add Button to create a VPN connection rule.
Go to
Configuration > Network > Interface > VTI
then click Add button to create a VTI interface.
2) Set Up the IGMP proxy function
On USG#1, go to Configuration > Network > Interface
- Edit WAN1 interface: Enable IGMP Support function and set it as Downstream
- Edit LAN1 interface: Enable IGMP Support function and set it as Upstream
- Edit vti0 interface: Enable IGMP Support function and set it as Downstream
On USG#2, go to
Configuration > Network > Interface
- Edit WAN1 interface: Enable IGMP Support function and set it as Upstream
- Edit LAN1 interface: Enable IGMP Support function and set it as Downstream
- Edit vti0 interface: Enable IGMP Support function and set it as Upstream
3) Add policy route to allow IGMP traffic to the remote site
On both USGs, create an IP range object for IGMP.
Go to
Configuration > Object > Address/GeoIP
Click the Add button.
On both USG, create a policy route to route IGMP traffic to the remote VPN tunnel.
Go to
Configuration > Network > Routing > Policy Route
Click the Add button.
4) Verification
After setting up the configuration, you can go to Monitor > IGMP Statistics to check, if any IGMP is working on the table.
Note
The IGMP proxy function can route IGMP traffic into a VPN tunnel.
You must select the correct IGMP direction when setting up the IGMP proxy.
Comments
0 comments
Please sign in to leave a comment.