Subject: Re: Minimum bandwidth for MBONE

From: Ross Finlayson <[email-masked]>
Date: Sat, 12 Apr 1997 16:03:14 -0700 (PDT)

At 10:11 AM 4/12/97 PDT, Bill Fenner wrote:
>John Roberts <[email-masked]> wrote:
>>How would I deploy MBONE services within my orgization when we have a
>>firewall segment (with registered addresses) routed to our internal
>>segments (non-registered 192.168.x.x addresses).
>
>The best solution to this problem is to have two totally seperate multicast
>routing domains - one on the firewall segment, connected to the MBone, and
>one internal.  Set up application gateways (e.g. an RTP translator) on a
>machine which is in both domains.

A variation on this approach is to set up a tunneling/relaying mechanism -
through your firewall - between an internal machine and one that's external
(just beyond your firewall).  This is more complicated, but requires less
modification to your main firewall machine.

>The hard part is starting up the application
>gateway at the right time (e.g. when people start tools on the inside).

Yes, somehow the internal machine needs to find out when multicast groups
are being joined/left on the internal network.  Down the road, probably the
best way to do this will be to use the new IGMP domain-wide reports &
queries that Bill described in an IDMR session at the Memphis IETF earlier
this week.  But until this mechanism is deployed on the internal network,
you need to figure this out some other way.

The trick (hack) I used at Sun, when I implemented their MBone relaying
mechanism, was to always relay SDP announcements (on the default SAP group
address/port), and to have the internal machine watch these announcements
for 'candidate' multicast groups.  It figured out whether/when these groups
had members (on the internal network) by periodically sending ICMP ECHO
packets to each group, and listening for responses.  The main drawback of
this approach (apart from all of the ICMP traffic, which you can keep under
control by being careful about the sending frequency and the TTLs) is that
it works only for a specific set of candiate multicast addresses - in this
case, multicast addresses that are mentioned in SDP announcements on the
default SAP group address/port.

>Ross Finlayson presented a firewall infrastructure similar to this at the
>MMUSIC session of an IETF (but I don't remember which).

This was at the Stockholm IETF, in an IDMR session (which was a bit
confusing, because no real multicast *routing* was being done across the
firewall).  FYI, the slides for this presentation (PowerPoint format) are
online at ftp://ftp.lvn.com/ietf/1995.07/mbonefw.ppt

        Ross.