Configuring PIM in Gaia Clish

Important - In a Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must configure all the Cluster Members in the same way.

To see the available "set" commands for PIM, enter in Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell).:

set pim[Esc][Esc]

To see the available "show" commands for PIM, enter in Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Clish:

show pim[Esc][Esc]

To see the available "restart" commands for PIM, enter in Gaia Clish:

restart pim[Esc][Esc]

Syntax

set pim

assert-interval {<1-3600> | default}

assert-rank protocol <Protocol> rank {<0-255> | default}

bootstrap-candidate

local-address {<IPv4 address> | default}

{off | on}

priority {<0-255> | default}

candidate-rp

advertise-interval {<1-3600> | default}

local-address {<IPv4 address> | default}

multicast-group <IPv4 address>/<Subnet mask> {off | on}

{off | on}

priority {<0-255> | default}

data-interval {<11-3600> | default}

hello-interval {<1-21845> | default}

interface <Name of Interface>

dr-priority {<0-4294967295> | default}

{off | on}

virtual-address {off | on}

interface-all-off

jp-delay-interval {<1-3600> | default}

jp-interval {<1-3600> | default}

mode {dense | sparse | ssm}

register-suppress-interval {<60-3600> | default}

state-refresh {off | on}

state-refresh-interval {<1-255> | default}

state-refresh-ttl {<1-255> | default}

static-rp

{off | on}

rp-address <IPv4 address>

multicast-group <IPv4 address>/<Subnet mask> {off | on}

{off | on}

Parameters

The mandatory parameters are marked Mandatory. All other parameters are optional.

Parameter

Description

assert-interval {<1-3600> | default}

Configures the assert interval.

If an assert battle on an upstream interface results in the selection of a PIM neighbor other than the unicast reverse-path-forwarding (RPF) neighbor towards the source of the data traffic (for which the assert battle was generated) as the designated forwarder on that interface, then the winner is used as the upstream neighbor for all subsequent join/prune messages.

This change is timed-out after expiry of the assert interval.

Range: 1-3600 seconds

Default: 180 seconds

assert-rank protocol <Protocol>

Configures the protocol, for which to configure the assert rank:

bgp - Routes learned via the BGP protocol
direct - Routes directly connected to a network interface
kernel - Kernel routes
ospf - Routes learned via the OSPF protocol
ospfase - External routes learned via OSPF
rip - Routes learned via the RIP protocol
static - Static routes

rank {<0-255> | default}

Configures the protocol rank to compare the cost of protocols to find which router will forward multicast data packets on a multi-access LAN.

These values are used in assert messages sent out on a LAN when a router detects data packets on an interface other than the incoming interface towards the source of the data.

These values must be the same for all routers on a multi-access LAN that run the same protocol.

Therefore, the default values were specially configured to match those of other implementations.

Range: 0-255
Defaults:
- BGP: 170
- Direct: 0
- Kernel: 40
- OSPF: 10
- RIP: 100
- Static: 60

bootstrap-candidate local-address {<IPv4 address> | default}

Configures the Bootstrap Candidate Local Address used for the C-BSR state machine and the bootstrap messages.

Important:

On a single Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources., this address can be that of the PIM interfaces or an address configured on the loopback interface. If an address from the loopback interface is used, do not select an address in the 127/8 address range.
On a ClusterXL Cluster Member Security Gateway that is part of a cluster. or VRRP Cluster Member, you must configure the Cluster Virtual IP address configured on this PIM interface.

Range: Address of PIM interface, or a non 127.0.0.0/8 loopback address.

Default: The IP address of one of the interfaces on which PIM is enabled. The default does not apply on Cluster Members.

bootstrap-candidate {off | on}

Disables (off) or enables (on) the Bootstrap Candidate.

bootstrap-candidate priority {<0-255> | default}

Configures the priority advertised in C-BSR messages.

The candidate bootstrap router with the highest priority value is selected as the bootstrap router for the domain.

The C-RP with the lowest priority has the highest preference.

The highest priority value is 0.

Range: 0-255

Default: 0

candidate-rp advertise-interval {<1-3600> | default}

Configures the candidate Rendezvous Point (RP) Advertisement Interval.

candidate-rp local-address {<IPv4 address> | default}

Configures the Candidate Rendezvous Point router address used for the C-RP state machine and in the C-RP-Advertisements sent to the elected bootstrap router.

Important:

On a single Security Gateway, this address can be that of the PIM interfaces or an address configured on the loopback interface. If an address from the loopback interface is used, do not select an address in the 127/8 address range.
In ClusterXL Cluster Member or VRRP Cluster Member, you must configure the Cluster Virtual IP address configured on this PIM interface.

Range: Address of PIM interface or a non 127.0.0.0/8 loopback address.

Default: Selects the IP address of one of the interfaces on which PIM is enabled. The default does not apply on Cluster Members.

candidate-rp multicast-group <IPv4 address>/<Subnet mask> {off | on}

Configure the Multicast Group, for which this router is designated as the candidate rendezvous point.

<IPv4 address>

The multicast IP address of the group(s) in CIDR notation, for which this rendezvous point is responsible.

Range: Dotted-quad ([224-239].[0-255].[0-255].[0-255])

Default: 224.0.0.0/4
<Subnet mask>

Mask length.

Range: 1-32

Default: None

candidate-rp {off | on}

Disables (off) or enables (on) Gaia as a candidate rendezvous point router.

candidate-rp priority {<0-255> | default}

Configures the priority of this C-RP.

All PIM routers select the same RP for a multicast group address from the list of C-RPs received in the bootstrap messages from the elected BSR.

The lower the Local Preference of the C-RP, the higher the priority.

Range: 0-255

Default: 0

data-interval {<11-3600> | default}

Configures the life-time of a new PIM forwarding entry.

Subsequently, the life of the entry is extended in different ways based on the location of this router in the network.

For example, in some cases the receipt of PIM control messages (periodic join/prune messages) extends the life of the entry and in others the presence of local senders of multicast traffic prevents the deletion of the entry.

Range: 11-3600 seconds

Default: 210 seconds

hello-interval {<1-21845> | default}

Configures the interval between PIM Hello messages that are sent on a multicast-capable interface.

Hello messages are addressed to the All-PIM-Routers multicast group (224.0.0.13), so that PIM routers may discover neighbors on a multi-access network.

Range: 1-21845 seconds

Default: 30 seconds

interface <Name of Interface>

Mandatory.

Specifies the interface, on which to enable PIM.

interface <Name of Interface> dr-priority {<0-4294967295> | default}

Configures the Designated Router priority advertised in the PIM Hello messages that are sent on the interface.

This is used for DR selection on a LAN.

The router with the highest priority is selected as the designated router.

To break a tie, the DR is selected on the basis of the highest IP address.

If even one router does not advertise a DR priority configured, the DR election is based on the IP address.

Note - To make sure that a PIM neighbor supports DR Priority:

Run this command in Gaia Clish on the Security Gateway:

show pim neighbor <IP Address of Neighbor>

For neighbors that advertise a DR selection priority value, this message shows in the summary:

DRPriorityCapable Yes

Range: 0-4294967295

Default: 1

interface <Name of Interface> {off | on}

Disables (off) or enables (on) PIM on the specified interface.

interface <Name of Interface> virtual-address {off | on}

Disables (off) or enables (on) the use of the VRRP Virtual IP address on this interface:

PIM runs on this interface only after the router becomes a VRRP Master after a failover.
Creates the neighbor relationship with the Virtual IP, if the router is a VRRP Master. The VRRP Master in the VRRP pair sends Hello messages that include the Virtual IP as the source address and processes PIM control messages from routers that neighbor the VRRP pair.

Note - You cannot configure this option when ClusterXL is enabled.

Range: off, or on

Default: off

interface-all-off

Disables PIM on all interfaces.

jp-delay-interval {<1-3600> | default}

Configures the maximal interval from the time when the unicast Reverse Path Forwarding (RPF) neighbor (towards a source or the RP) changes, and a triggered Join/Prune message is sent.

Range: 1-3600 seconds

Default: 5 seconds

jp-interval {<1-3600> | default}

Configures the interval between sending Join/Prune messages.

Range: 1-3600 seconds

Default: 60 seconds

mode {dense | sparse | ssm}

Mandatory.

Configures the PIM mode:

dense - Dense Mode
sparse - Sparse Mode
ssm - Source-Specific Multicast

register-suppress-interval {<60-3600> | default}

Configures the mean interval between receipt of a register-stop and the time when registers can be sent again.

A lower value means more frequent register bursts at the rendezvous point.

A higher value means a longer join latency for new receivers.

Range: 60-3600 seconds

Default: 60

state-refresh {off | on}

Disables (off) or enables (on) the use of state refresh messages to delay timing out prune state of multicast traffic that has no active receivers.

This helps suppress the flood-and-prune cycle inherent to Dense Mode.

state-refresh-interval {<1-255> | default}

For Dense Mode, configures the interval at which state refresh messages are sent for multicast traffic originated by directly-connected sources.

Range: 1-255 seconds

Default: 60 seconds

state-refresh-ttl {<1-255> | default}

For Dense Mode, configures the time-to-live (TTL) placed in the state refresh messages originated for multicast traffic from directly-connected sources.

You can use this value to limit the forwarding of state refresh messages in the network.

In the absence of user configuration, it is derived from the multicast data.

Range: 1-255

Default: None

static-rp {off | on}

Disables (off) or enables (on) the router as a Static Rendezvous Point.

static-rp rp-address <IPv4 address>

Configures the Static Rendezvous Point IP address.

If an associated multicast group and prefix is not configured, the Static Rendezvous Point (RP) is considered to be responsible for all multicast groups (224.0.0.0/4).

This needs to be consistent with the RP information at other routers in a multicast domain irrespective of the RP-dissemination mechanism (bootstrap or autoRP) used.

Note - The static RP overrides the RP information received from other RP-dissemination mechanisms, such as bootstrap routers.

Range: Any IP address

Default: None

static-rp rp-address <IPv4 address> multicast-group <IPv4 address>/<Subnet mask> {off | on}

Configures the Multicast Group, for which this router is designated as the static rendezvous point.

<IPv4 address>

The multicast IP address of the group(s) in CIDR notation, for which this rendezvous point is responsible.

Range: Dotted-quad ([224-239].[0-255].[0-255].[0-255])

Default: 224.0.0.0/4
<Subnet mask>

Mask length.

Range: 1-32

Default: None

static-rp rp-address <IPv4 address> {off | on}

Disables (off) or enables (on) the specified static Rendezvous Point.