Cross VLAN Multicast / PIM Config

djfraz · Sun Aug 20, 2023 6:20 am

I have done a ton of searching and am still at a loss. I have a CCR2004 (ROS v7.10.2) router and am trying to get multicast to route between subnets. I have my main LAN subnet, (192.168.1.0/24) and an IoT network (192.168.20.0/24 - VLAN). If my phone is on the same VLAN as my smart home devices, everything works perfect. If I'm on my LAN, I can't get things to work right (ie: Google home app tells me to join the same wifi as my devices).

I have firewall rules setup to allow my LAN and IoT network to access any subnet, but multicast doesn't appear to be routing like everything else does.

I'm very new to Mikrotik configs and setup. Coming from pfSense environment. I know i'm going to be missing important information, so ask if you need it, but trying to get this fixed is a new journey lol

Looking for specific instructions on configuring PIM. Did a lot of Googling over the past couple weeks off and on and still stuck.

DarkNate · Sun Aug 20, 2023 11:24 am

PIM is non-functional on RouterOS v7.

You should contact MikroTik support.

jbl42 · Sun Aug 20, 2023 2:55 pm

While this can be achieved with PIM, it is quite a big gun to get AirPlay/Chrome/IoT working among routed VLANs.
All those systems rely on mDNS (a simple multicast based DNS system, aka as Bonjour in the Apple world) for devices to find each other. mDNS is designed to work inside an IP subnet resp. L2 broadcast domain and excluded from L3 routing per relevant RFCs.

What is required to have mDNS working among subnets is mDNS forwarder and/or IGMP proxy as for ex. provided by OPN/pfsense.
This can be done running a container (docker) image in ROS, see viewtopic.php?p=1014570&hilit=mdns#p1013639
and also
https://help.mikrotik.com/docs/display/ROS/Container

djfraz · Sun Aug 20, 2023 9:35 pm

So I got the container installed, I guess the issue i'm having now is, would I need to assign a VLAN ID to my primary bridge? If I use VLAN 1 in the container, it won't grab an IP.

anav · Sun Aug 20, 2023 9:47 pm

Dont use vlan1 for data, use any other number

jbl42 · Sun Aug 20, 2023 10:27 pm

For each VLAN requiring mDNS "routing" by the container, add a veth and addd it to the bridge with matching PID.
If your main bridge uses default VLAN1 for untagged traffic, add a veth with PID1 to the bridge.

DarkNate · Mon Aug 21, 2023 12:56 pm

Dont use vlan1 for data, use any other number

VLAN1 does not matter in non-Cisco gear. On Linux aka RouterOS, you just need to ensure bridge ingress filtering to drop untagged “native” VLAN. You can use VLAN 1 just like any other VLAN. I use VLAN1 for MGMT traffic, but you can use it for whatever you want.

But man, too many people lack clear networking fundamentals to even know this.

mkx · Mon Aug 21, 2023 2:04 pm

But man, too many people lack clear networking fundamentals to even know this.

To use VLAN 1 in MT world, one has to speak ROSish quite fluently ... it's not a problem of VID itself, the problem is that it's used in ROS as implicit default all over place and one has to know how to look to see it. And then change it according to needs. Which might be too much of a hassle, thus recommendation to avoid VID=1 if possible. Effectively it's the same as Cisco (with it's native VLAN concept) and many other vendors, who all treat VLAN with ID=1 in some special way (ROS is quite modest at it, it allows one to reconfigure things which is more than some others allow).

DarkNate · Mon Aug 21, 2023 5:49 pm

To use VLAN 1 in MT world, one has to speak ROSish quite fluently ... it's not a problem of VID itself, the problem is that it's used in ROS as implicit default all over place and one has to know how to look to see it. And then change it according to needs. Which might be too much of a hassle, thus recommendation to avoid VID=1 if possible. Effectively it's the same as Cisco (with it's native VLAN concept) and many other vendors, who all treat VLAN with ID=1 in some special way (ROS is quite modest at it, it allows one to reconfigure things which is more than some others allow).

You misunderstood me. VLAN 1 has special value or meaning only in Cisco in the world of network engineering as a whole:
https://lostintransit.se/2022/09/05/is- ... -networks/

On Juniper, Arista, MikroTik, Cumulus - All these stated vendors, allow you to prune VLAN 1. On MikroTik this means:

/interface bridge
add frame-types=admit-only-vlan-tagged name=bridge vlan-filtering=yes

Kentzo · Mon Aug 21, 2023 10:39 pm

trying to get multicast to route between subnets.

First step is to understand nature of your multicast. If it's routable, then your need IGMP Proxy or PIM (as well as a careful look into IGMP Snooping, Multicast helpers etc). If it's non-routable than you need a repeater of some sort.

E.g. mDNS's multicast is non-routable and you would need a repeater such as Avahi. Or you could add specifically crafted static DNS records to your DNS server (mDNS/DNS-SD). The latter is the preferred solution for wide area mDNS.

mkx · Tue Aug 22, 2023 7:06 am

You misunderstood me.

I understood you well. On the other hand you're underestimating the number of necessary changes to get rid of VLAN 1 use in ROS:

/interface bridge
add frame-types=admit-only-vlan-tagged name=bridge vlan-filtering=yes

The above only takes care of bridge port. One has to deal with the issue on the rest of bridge ports as well (the way of dealing it depends on whether port is untagged access port, hybrid port or trunk port).

Again, I'm not saying it can't be done, in contrary, it can be done. But, again, for inexperienced user it's only too easy to miss all the points where it has to be done so it's way easier to use other VIDs if there isn't a very good reason to use VID 1 in tagged traffic.

DarkNate · Tue Aug 22, 2023 11:27 am

Again, I'm not saying it can't be done, in contrary, it can be done. But, again, for inexperienced user it's only too easy to miss all the points where it has to be done so it's way easier to use other VIDs if there isn't a very good reason to use VID 1 in tagged traffic.

We all started from somewhere. I started with computer science and CCNA syllabi. If a user is unwilling to learn computer science and network engineering fundamentals to do network engineering, they should quit while they are ahead.

I'm speaking as someone who was once a noob.

mkx · Tue Aug 22, 2023 1:54 pm

I'm speaking as someone who was once a noob.

Good for you. I sometimes wonder if you actually understand posts by other (inexperienced) users ...

Only a few users on this forum have desire to get beyond basic networking knowledge (enough to make their home network somehow working) and for the rest advice to stay away from VLAN 1 is pretty good advice IMO. If one goes beyond basic knowledge, then he will know all the bells and whistles. Unlike many others on this forum I try to help solve fellow members' problems (and try to explain a thing or two on the way). I'm not upset if someone's knowledge level is below my own (which, I'm honest with myself, is not very high) ... unlike some other forum members who get nervous when dealing with users with inadequate knowledge.

Guscht · Tue Aug 22, 2023 3:57 pm

PIM is non-functional on RouterOS v7.

Is this sill the case? I did a lot PIM-routing stuff around 2018/2019 with ROSv6 and it worked really good.
Cant believe they still werent able to fix an alredy good working (in v6) feature...

DarkNate · Tue Aug 22, 2023 7:37 pm

Is this sill the case? I did a lot PIM-routing stuff around 2018/2019 with ROSv6 and it worked really good.
Cant believe they still werent able to fix an alredy good working (in v6) feature...

It's not working on latest ROS v7.11 stable at least. And MikroTik did not provide PIM config documentation for ROSv7 either.

I suggest you raise a support ticket to push them to fix it.

PIM is an ancient protocol that's like 20 years old. I don't know how MikroTik doesn't support 20-year-old protocols natively and smoothly.

Tue Aug 22, 2023 8:37 pm

MikroTik did not provide PIM config documentation for ROSv7 either.

It is true that PIM was undocumented on the new v7-centric help site for a long time, but that changed in October of last year. I haven’t had a good excuse to add VLANs to my MT LAN and then configure PIM-SM to route multicast between them, but why write all those new docs in a spurt of 12 new versions if nothing about it works?

I took the appearance of that new material as an indication that they’d gotten something working on v7.

like 20 years old

Twenty-six.

DarkNate · Sat Sep 02, 2023 3:11 am

I did a netinstall of v7.11.2. PIM seems to be working with early testing. Config example for people:

/routing pimsm instance
add afi=ipv4 disabled=no name=pimsm-IPv4 vrf=main
add afi=ipv6 disabled=no name=pimsm-IPv6 vrf=main

/routing pimsm interface-template
add disabled=no instance=pimsm-IPv4 interfaces="VLAN200" source-addresses=x.x.x.x
add disabled=no instance=pimsm-IPv6 interfaces="VLAN200" source-addresses=x.x.x.x
add disabled=no instance=pimsm-IPv4 interfaces="VLAN300" source-addresses=x.x.x.x
add disabled=no instance=pimsm-IPv6 interfaces="VLAN300" source-addresses=x.x.x.x

/interface bridge
add igmp-snooping=yes igmp-version=3 mld-version=2 name=bridge

Keep in mind, I'm using the official recommended bridge VLAN filtering to ensure IGMP/MLD Snooping works correctly:
https://help.mikrotik.com/docs/display/ ... +switching

broderick · Wed Oct 04, 2023 10:24 pm

I did a netinstall of v7.11.2. PIM seems to be working with early testing. Config example for people:

/routing pimsm instance
add afi=ipv4 disabled=no name=pimsm-IPv4 vrf=main
add afi=ipv6 disabled=no name=pimsm-IPv6 vrf=main

/routing pimsm interface-template
add disabled=no instance=pimsm-IPv4 interfaces="VLAN200" source-addresses=x.x.x.x
add disabled=no instance=pimsm-IPv6 interfaces="VLAN200" source-addresses=x.x.x.x
add disabled=no instance=pimsm-IPv4 interfaces="VLAN300" source-addresses=x.x.x.x
add disabled=no instance=pimsm-IPv6 interfaces="VLAN300" source-addresses=x.x.x.x

/interface bridge
add igmp-snooping=yes igmp-version=3 mld-version=2 name=bridge

#To prevent SLAAC from breaking. Also DO NOT SPECIFY VID here.#
/interface bridge mdb
add bridge=bridge group=ff02::2 ports=bridge,ether2,ether3,ether4,ether5

Keep in mind, I'm using the official recommended bridge VLAN filtering to ensure IGMP/MLD Snooping works correctly:
https://help.mikrotik.com/docs/display/ ... +switching

I set 3 interfaces in bridge (my main LAN), set also services on it. On another interface I set a different subnet for GUEST.
Would your setup work for DLNA discovery too? A device on the GUEST subnet needs to contact a service running on the LAN side.
Unfortunately I can't set up VLANs at the moment. Thanks

DarkNate · Thu Oct 05, 2023 1:48 pm

I set 3 interfaces in bridge (my main LAN), set also services on it. On another interface I set a different subnet for GUEST.
Would your setup work for DLNA discovery too? A device on the GUEST subnet needs to contact a service running on the LAN side.
Unfortunately I can't set up VLANs at the moment. Thanks

If you don't have VLANs, you don't need PIM nor IGMP Proxy. The basic IGMP/MLD snooping configuration should be sufficient.

PIM/IGMP Proxy is for inter-VLAN routing.

llamajaja · Thu Oct 05, 2023 2:06 pm

So the conclusion is that with the latest firmware one can multicast between vlans successfully?

broderick · Thu Oct 05, 2023 3:41 pm

I set 3 interfaces in bridge (my main LAN), set also services on it. On another interface I set a different subnet for GUEST.
Would your setup work for DLNA discovery too? A device on the GUEST subnet needs to contact a service running on the LAN side.
Unfortunately I can't set up VLANs at the moment. Thanks
If you don't have VLANs, you don't need PIM nor IGMP Proxy. The basic IGMP/MLD snooping configuration should be sufficient.

PIM/IGMP Proxy is for inter-VLAN routing.

I have most likely failed to understand it correctly, but by reading this wiki:
https://help.mikrotik.com/docs/pages/vi ... d=59277403
The IGMP/MLD snooping can be set only for ports on the same bridge, which it doesn't seem to be my case.

Thanks

DarkNate · Thu Oct 05, 2023 3:55 pm

The IGMP/MLD snooping can be set only for ports on the same bridge, which it doesn't seem to be my case.

You are not supposed to be using multiple bridges, read this:
viewtopic.php?p=1026098#p1026101

broderick · Thu Oct 05, 2023 4:07 pm

The IGMP/MLD snooping can be set only for ports on the same bridge, which it doesn't seem to be my case.
You are not supposed to be using multiple bridges, read this:
viewtopic.php?p=1026098#p1026101

It is a temporary setup. I'll will set VLANs on the same bridge when I buy another VLAN-capable device to plug to ether 3 (GUEST now) which is going to be set as a trunk port so that I can have multiple VLANs on the new device.

DarkNate · Thu Oct 05, 2023 9:08 pm

It is a temporary setup. I'll will set VLANs on the same bridge when I buy another VLAN-capable device to plug to ether 3 (GUEST now) which is going to be set as a trunk port so that I can have multiple VLANs on the new device.

You only need to configure access port based VLAN for your current setup, works fine on single bridge, doesn't need to be trunked.

broderick · Thu Oct 05, 2023 11:23 pm

It is a temporary setup. I'll will set VLANs on the same bridge when I buy another VLAN-capable device to plug to ether 3 (GUEST now) which is going to be set as a trunk port so that I can have multiple VLANs on the new device.
You only need to configure access port based VLAN for your current setup, works fine on single bridge, doesn't need to be trunked.

Maybe I'm missing something here. Yes same bridge but I meant that Ether3 must be connected to a VLAN-capable switch/AP (it will most likely be another Mikrotik device, I guess), so it needs to be set as tagged port (this is why I called it "trunk" port). I can set the rest of the other ethernet ports on my current MK router as access/untagged ports, except Ether1 , the WAN port. Does it make sense? Thanks

llamajaja · Sat Oct 07, 2023 7:58 pm

I noticed the following on 7.12rc............
*) pimsm - improved system stability;
but more importantly in my case
*) wifiwave2 - implemented an option to transmit IP multicast packets as unicasts;

Reason being is I am going to attempt on an AX3, replacing ppoe internet on vlan, and IPTV on vlan on my brothers movistar modem/router to the mt router.
The good news is that both the internet and iptv seem to be sent untagged out on the wifi LAN being put out by the movistar router part...........

Will post a separate thread......viewtopic.php?t=200364

Q. Will I need to change from 7.11.2 to 7.12rc ( if that feature is absolutely required - seems like an IGMPv2 proxy requirement thus far )

DarkNate · Sun Oct 08, 2023 2:08 pm

I have a CCR<>ax2 setup, where ax2 is a layer 2 devices only.

I never actually see PIM packets on my Wi-Fi clients for some reason, it seems wifiwave2 blocks PIM packets? I am not sure, but the MDB table is properly populated so not sure what's going on.

I check with WireShark on client side. I see PIM packets on ethernet though.

pfturner · Thu Mar 14, 2024 11:18 pm

I am currently using an mDNS repeater that works fine between VLAN10 (Personal), VLAN20 (Guest) and VLAN30 (IoT). I have Rokus, Printer and an Apple Airport Express (only purpose here is the 3.5mm connection to home speakers) all connected to switch access ports assigned to VLAN30 (IoT). However, I also have Unifi APs, using the PC controller it seems to require the native vlan "1".

What I would like to do is:

(1) remove VLAN10 and simply use native vlan 1 for Personal - in which case Unifi APs are happy --- but I need to get mDNS to work with the native vlan and VLAN20 and VLAN 30, instead of VLAN10) - have had no luck here despite trying to add eth0.1 or eth0 to the mDNS container config.

or

(2) replace the mDNS with a functioning PIM-SM configuration like DarkNate posted -- will this work with a native vlan and VLAN20/VLAN30 setup? What do I put in the source-address IP entries in that example? The receiver device IPs?

Thanks for any insights!

pfturner · Fri Mar 15, 2024 7:22 pm

I was able to solve the Unifi AP/native vlan issue today. Still would be happy for thoughts on the PIM implementation VLAN10-20-30 and what source-address refers to in that context. Regards.

Amm0 · Fri Mar 15, 2024 7:55 pm

(2) replace the mDNS with a functioning PIM-SM configuration like DarkNate posted -- will this work with a native vlan and VLAN20/VLAN30 setup? What do I put in the source-address IP entries in that example? The receiver device IPs?

I believe PIM-SM follows the RFCs, so the link-local 224.0.0.51/24 of mDNS cannot be distributed via PIM (e.g. it's the 224.0.0 "dst-address" that's not allowed so src-address does not even come into play).

If you have Ruckus AP, and those are connected to all the needed VLANs, Ruckus has a good mDNS repeater features – I'd probably use that to deal with mDNS between VLANs.

@UpRunTech has tried a few approaches, which result in avoiding PIM / IGMP Proxy, and using bridge filters: viewtopic.php?t=204025&hilit=mdns

Mikrotik, well a year ago, discussed adding proper mDNS / DNS-SD support

MikroTik is working on mDNS repeater, but that will come together with a global DNS overhaul and it will be an improvement in all areas, not just this one. This is also why it takes some time to make.

...in the ~100K x viewed thread on the mDNS topic (and started in 2021): viewtopic.php?t=174354&hilit=mdns#p992798

pfturner · Fri Mar 15, 2024 9:24 pm

Thanks, I'll read up on those suggestions. At least the mDNSNs repeater works well between VLAN10-20-30.

Cross VLAN Multicast / PIM Config

Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Re: Cross VLAN Multicast / PIM Config

Who is online