Description

To count the number of multicast packects within a Multicast VPN, you have to apply the ingress firewall filter on the remote PE or transit P routers, matching with the MVPN multicast group address, soure address (global loopback address)  and the protocol as GRE.

Symptoms

When troubleshooting, you may not know if upstream router is sending the GRE encapsulated multicast traffic. Also, in certain cases, the downstream router might  receive and drop the GRE encapsulated multicast traffic.

Solution

Firewall configuration :
lab@SODIUM# show firewall family inet filter catch-239
term 1 {
     from {
         source-address {
             1.1.1.1/32;  >>>>>>>>. global loopback address on the PE router
         }
destination-address {
    239.1.1.1/32;
}
protocol gre;
}
then {
    count count-239;
    accept;
}
     }
lab@SODIUM# run show firewall filter catch-239 counter count-239
Filter: catch-239
Counters:
Name                Bytes            Packets
count-239           546                  7
The ingress and egress filters can be applied only on the MPC Cards. For the rest of the platforms, it is applicable to only the ingress filter.