Subject: tunneling over Firewall 1

From: Bill Friday <[email-masked]>
Date: Fri, 06 Dec 96 09:07:13 EST

Greetings,

I am trying to create an Intranet mbone tunnel that is on the other
side of Firewall 1 firewall that only permits telnet, ftp, xwindows,
http, icmp and a few other apps and denies everything else. I am able
to get the tunnel to indicate that it is up via mstat but I don't think
the firewall is forwarding any multicast information since sdr doesn't
show the advertised sessions that are seen on the originating side of
the firewall. I tried starting a local session and that does not get
forwarded either.

Since I know very little about Firewall 1, does anyone know what rule
set would be required to permit sdr and all other mbone applications to
work over a tunnel? Any advise would be appreciated.

Thanks in advance,
Bill

--------------------------------------------------------------------
Bill Friday 		    email:  [email-masked] 
Philips Research			       Voice: (914) 945-6087
Senior Network Administrator			 Fax: (914) 945-6511
Communications and Computing Resources
345 Scarborough Road
Briarcliff Manor, NY USA 10510
--------------------------------------------------------------------

---

From: dave pratt <[email-masked]>
Date: Fri, 6 Dec 1996 14:31:59 +0000 (GMT)

Bill,

You need ip-in-ip and IGMP to be passed through the firewall, in both
directions between the tunnel end points.

If you just allow IGMP, mrouted will think the tunnel is up, but it won't
receive any traffic. This may be what you're experiencing.

If it's a cisco router acting as a firewall then I can help further, but I'm
not familiar with a product "Firewall 1".

Cheers
--------
Usual Disclaimers apply.
WWW - doesn't that stand for "Wait a Week Word" ?
   Nope - It's Wait a Week Windows !
Dave Pratt      (tel: +44 1473 643840 )
[email-masked]

On Fri, 6 Dec 1996, Bill Friday wrote:
->Subject: tunneling over Firewall 1
->
->Greetings,
->
->I am trying to create an Intranet mbone tunnel that is on the other
->side of Firewall 1 firewall that only permits telnet, ftp, xwindows,
->http, icmp and a few other apps and denies everything else. I am able
->to get the tunnel to indicate that it is up via mstat but I don't think
->the firewall is forwarding any multicast information since sdr doesn't
->show the advertised sessions that are seen on the originating side of
->the firewall. I tried starting a local session and that does not get
->forwarded either.
->
->Since I know very little about Firewall 1, does anyone know what rule
->set would be required to permit sdr and all other mbone applications to
->work over a tunnel? Any advise would be appreciated.
->
->Thanks in advance,
->Bill
->
->--------------------------------------------------------------------
->Bill Friday 		    email:  [email-masked] 
->Philips Research			       Voice: (914) 945-6087
->Senior Network Administrator			 Fax: (914) 945-6511
->Communications and Computing Resources
->345 Scarborough Road
->Briarcliff Manor, NY USA 10510
->--------------------------------------------------------------------
->

---

From: Dino Farinacci <[email-masked]>
Date: Fri, 6 Dec 1996 09:21:46 -0800

>> directions between the tunnel end points.

    That is IP protocol number 2 and 4 needs to leak through the firewall.

Dino

---

From: [email-masked] (Matthias Urlichs)
Date: 7 Dec 1996 22:12:00 +0100

In dist.mbone, article <[email-masked]>,
> receive any traffic. This may be what you're experiencing.
This configuration also effectively disables any pruning.
Not a good idea.

The firewall may send appropriate ICMP messages back, but as far as I know
(and from what I've seen on our Linux mrouter where I initially forgot to
load the IPIP decapsulator), Cisco's code summarily ignores them. :-(

-- 
The steady state of disks is full.
                   -- Ken Thompson
-- 
Matthias Urlichs         \  noris network GmbH  /  Xlink-POP N|rnberg 
Schleiermacherstra_e 12   \   Linux+Internet   /   EMail: [email-masked]
90491 N|rnberg (Germany)   \    Consulting+Programming+Networking+etc'ing
   PGP: 1024/4F578875   1B 89 E2 1C 43 EA 80 44  15 D2 29 CF C6 C7 E0 DE
       Click <A HREF="http://info.noris.de/~smurf/finger">here</A>.    42