⇒Here I wrote how to configure a FortiGate with managed FortiSwitches as IGMP querier. It is a good solution if the multicast traffic has to pass the FortiGate. If the multicast traffic has to remain in the local subnet, this configuration has a big disadvantage. All multicast streams are sent towards the FortiGate. Having multiple TV streams, this will saturate if firewall interface quickly.
Using a pure layer 2 multicast application you better use the IGMP snooping querier directly on the FortiSwitch.
For an AV over IP project from ⇒Crestron we had to find out the configuration by try and error. The support of Fortinet was no help.
The problem we have is well ⇒documented by Cisco.
Here the way how to configure it:
The VLAN used must have IGMP snooping activated. Using MCLAG must use IGMP proxy. These settings are done directly on the FortiGate.
config system interface edit "v0007_client" set vdom "root" set ip 10.0.3.254 255.255.255.0 set allowaccess ping set switch-controller-igmp-snooping enable set switch-controller-igmp-snooping-proxy enable set switch-controller-igmp-snooping-fast-leave enable next end
IGMP Snooping is now configured, but we do not receive membership reports yet.
Now we configure IGMP snooping querier on one switch
This must be configured directly on the FortiSwitch. So use the CLI to connect to it and add the configuration:
config switch vlan edit 7 set igmp-snooping enable set igmp-snooping-querier enable set querier-addr 10.0.3.1 set igmp-proxy enable next end
The important parameters are igmp-snooping-querier enable and querier-addr. The IP address used for querier-addr has to be an IP address from the subnet used. Once configured, the switch sends query requests. All multicast receiver in this subnet respond now to these requests. That allows all switches to fill the forwarding tables. Multicast traffic is now only sent to ports with a receiver xpecting the stream.
The frequency of the queries has to be configured directly on the switch too.
config switch igmp-snooping globals set query-interval 60 end
In this example, the switch sends a query every 60 seconds. By default it is 120 seconds.
On a second switch you can configure a backup querier. In this case you do exactly the same. The only thing different is the IP address. Since there must be only one querier per subnet, the second querier stays quiet, if it receives queries from another querier with a lower IP address.