Is the firewall running multi-context routed mode or single context? If multi-context then Multicast isn't supported and you need to tunnel Multicast thru the ASA using a GRE tunnel. If single context have you configured the ASA for Multicast routing and configured the RP on the ASA?
Regards, Tyson Scott - CCIE #13513 R&S, Security, and SP Managing Partner / Sr. Instructor - IPexpert, Inc. Mailto: <mailto:[email protected]> [email protected] Telephone: +1.810.326.1444, ext. 208 Live Assistance, Please visit: <http://www.ipexpert.com/chat> www.ipexpert.com/chat eFax: +1.810.454.0130 IPexpert is a premier provider of Self-Study Workbooks, Video on Demand, Audio Tools, Online Hardware Rental and Classroom Training for the Cisco CCIE (R&S, Voice, Security & Service Provider) certification(s) with training locations throughout the United States, Europe, South Asia and Australia. Be sure to visit our online communities at <http://www.ipexpert.com/communities> www.ipexpert.com/communities and our public website at <http://www.ipexpert.com/> www.ipexpert.com From: [email protected] [mailto:[email protected]] On Behalf Of Kingsley Charles Sent: Saturday, January 01, 2011 2:10 PM To: manish ludhani Cc: [email protected] Subject: Re: [OSL | CCIE_Security] GETVPN multicast rekey through ASA Can you post the configs of KS, ASA and GM on outside. With regards Kings On Sat, Jan 1, 2011 at 2:52 AM, manish ludhani <[email protected]> wrote: Hi all, i am stuck at GETVPN multicast rekey through ASA seems a common catch. i hv looked at all the previous posts but still not able to make it work. i am using asa in routed mode and KS is inside the firewall. i receive the Rekeys on the GMs which are inside the firewall but not on the outside GMs i hv enabled the routing on ASA inside outside interfaces and defined RP. i tried to enable mpacket debug and noticed i was not receiving any multicast traffic packet tracer from inside source KS to multicast address fails (Early security checks failed). i will b gr8ful if any1 please give me any clue. Regards Manish _______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
