This article explains the need for the configuration of a separate security policy to allow multicast flows through the SRX device, when acting as an intermediate/transient router for multicast traffic. For example configurations of this security policy, refer to the following articles:
Although there is no specific application traffic for UDP port 2, the multicast flow is seen to be blocked by the SRX if there is no explicit security policy defined for allowing UDP port 2 traffic. This scenario involves the SRX device acting as an intermediate/transient router for multicast traffic.
Multicast traffic is handled at the transport layer with UDP. TCP provides point-to-point connections, which is not feasible for multicast traffic. The SRX flow session uses tuple-based matching for maintaining state of traffic flows, involving the parameters of source IP, source port , destination IP, destination port, protocol. Hence, the SRX populates protocol UDP and port 2 in the flow session so that the firewall can handle return traffic as a part of the initiated session.
An explicit security policy is required for multicast updates. Since the SRX firewall has an implicit deny, we can allow this traffic under a specified policy using a custom application with protocol UDP and destination-port 2 or the in-built junos-udp-any application. Here, we will use the system pre-defined application junos-udp-any which accommodates protocol UDP for all ports, as seen below:
show configuration groups junos-defaults applications application junos-udp-any term t1 protocol udp;
The SRX flow module identifies with protocol UDP, port 2 under the security policy for the flow session and the multicast traffic destined for the multicast IP address is then allowed. The security policy in place accommodates multiple sessions associated with the same multicast flow, without having the need to configure separate policies.
For example configurations of this security policy, refer to the following articles:
2020-07-15: Article reviewed for accuracy; no changes required.