Cisco PBX multicasting questions
-
I have a cisco pbx that is sending constant multicast traffic from port 2000 to 239.2.2.2:2000. It's being blocked by the default rules. The only problem I have that is that it's creating so many log entries that I cannot diagnose a connection issue where the VLAN isn't responding to attempts for me to connect to it from my vpn. I'm using a filter to cut out the multicast, but what is it about the multicast that's causing pfsense to log the multicast traffic?
I'm not seeing where my attempt to ping addresses on that vlan from my vpn is being blocked by the firewall, but a packet capture only shows data from the vpn. It doesn't appear to be routed to the vlan, nor does it appear to be blocked (according to the status->system logs->firewall). Suggestions?
-
@plrpilot Sounds like you have 2 different issues.
Keep in mind that unless you are doing some sort of funky multicast proxy, multicast traffic does not leave the broadcast domain, so is of little use to a router.
You can safely put a rule above your mail outbound rule in your pfsense to deny this traffic and uncheck the logging option on the rule so you no longer see it in the logs.For the second problem, you mention a VLAN; by default new interfaces be they physical or virtual added to pfSense have no rules and block all traffic. That'd be where I'd start looking.
-
@awebster
Thanks. The first tip worked like a charm.For the remaining issue, I'm not able to ping devices on the network from the VPN. Since I'm initiating the contact from the vpn, I'd expect the traffic to pass through with no issues. However, I'm not seeing confirmation that the icmp traffic is passing. I have a vpn rule to allow traffic to all interfaces. I'm sure it's a weird error in my config, but I'm not sure how to diagnose it. My first reaction was to check the logs for blocks, but I'm not seeing it.
-
@plrpilot When you say "from the VPN", what is the device that is initiating the VPN on the remote side? Is it OpenVPN or IPSEC VPN?
Please provide additional information about the network topology, perhaps you need some specific routing.
