Using a dedicated router for KPN iTV

Well, as you probably have read on my other posts, I am some sort enthusiast to use my KPN internet and iTV subscription with my own gear (and not with the Experiabox that KPN included with my subscription). So that said, I also know that there are some difficulties where I can run in to. One of them was to successfully route the iTV traffic (which is multicast) through a FortiGate firewall. It works, yes, but I found that there are some “side-effects” which I didn’t like. One of the most annoying thing is that the internet-performance drops dramatically when both TV receivers are actively requesting a multicast stream. Mwa, that’s definitely not what I want :-(.

So I decided to split functionality over 2 devices; Internet traffic is routed through my FortiGate firewall, while multicast traffic is routed through a dedicated router (in my case this is a Mikrotik router). Be aware that if you want to use a router for the iTV multicast traffic, that it has to support some features to get it working.

Let’s begin with some graphics the show what I have build. See the basic drawings below:

I have a separate vlan where the TV-receivers reside. This vlan is directly routed through my Mikrotik router which handles the multicast traffic. The reason why the FortiGate is also present in the vlan, is that the receivers need internet-access for some services (such as Netflix). In my case, I made the FortiGate the DHCP server for this vlan, and points the default-gateway to the Mikrotik router.

Physically, I needed to handle the vlan ID’s which are present on my NTU. These ID’s are vlan 4 (for iTV) and vlan 6 (for internet). Vlan 5 is for telephony services, which I don’t use.

I configured pppoe on my FortiGate on the wan1 interface, which is connected to a port on the Mikrotik router in vlan 6. I don’t need to configure a subinterface on the FortiGate, because it is a native vlan port on the Mikrotik where I connect my FortiGate wan port. With this configuration, I keep the public IP address directly associated on my FortiGate’s wan port. Great!

The Mikrotik router is having a subinterface in vlan 4, where it is running a DHCP client to get an IP address from the KPN network. For this to work, you have to sent 2 options in the DHCP request.

DHCP client optionValue
55 (parameter 121)CLASSLESS_ROUTE

Option 60 is mandatory, otherwise you will not get an IP address at all.

Option 55 is a special one, which gets the route-information for the KPN network. If you have a Mikrotik router, this step is easy because the options can simple be enabled in the configuration with the “special classless” option.

The learned prefix from KPN is printed below.

For the multicast to work, I had to take care about firewalling (nat-masquerade) and IGMP proxying as well.

For your convenience, I have published my Mikrotik configuration on Github here.

Use a FortiGate with KPN interactive TV (part 2)

After I got my internet connection from KPN rolling through my FortiGate, the next step was to make interactive TV (iTV) working through my FortiGate as well.

Well, it was a bit of a puzzle to get this working, because of some special settings which are needed for iTV. But when all these things are set, iTV works (almost*) perfectly through the FortiGate.

So why almost* do you think? Well, after testing for a while, it seems that I have a problem with my Internet performance when I have 2 TV receivers active. When both receivers are active, they are using for about ~7-8 Mbps of bandwidth each. So, when 2 receivers are active, I only keeps several Mbits of internet speed left…(I have a 200/200 Mbps contract, which I can easily utilize for 100% when only 1 or no receivers are active). It seems to me that the multicast stream of 2 receivers is a bit to much for my FortiGate 60F.

I decided to route the TV traffic via a dedicated router, and that worked fine! Now I can fully utilize my internet connection even when both receivers are active. In my opinion, separating TV traffic through a dedicated router is the best solution. My router is a Mikrotik RB750Gr3.

This post describes the situation where all traffic is routed through the FortiGate. The situation where I route multicast TV traffic though a dedicated MikroTik router, will be described in a later post.

What do I have?

  • Internet from KPN (dutch ISP) with FTTH (Fiber-to-the-home) 200/200 Mbps
  • Interactive-TV from KPN
  • I do not use telephony from KPN
  • Experia box V10A from KPN
  • FortiGate 60F (FortiOS 6.4)
  • Internal switch where I can do some vlan-stuff with

You MUST use FortiOS 6.4 for this to work. Otherwise, the DHCP-client option which is used for iTV cannot be configured as this option is only available in FortiOS 6.4.

What did I want to realize?

I do not want to use the Experia box of KPN! I want to use my own FortiGate firewall to take over all the functions of the Experia box (apart from WiFi, where I have my own access-points)

What are the topics?

The topics to build are:

  • Internet-connectivity (IPv4 & IPv6) (see post part 1)
  • iTV including replay and recordings (this post, part 2)

Building iTV

My ISP-connection is delivered over fiber, which is delivered with an UTP-connection from the NTU. The UTP cable is going directly into the WAN-port of my FortiGate.

Good to know is that KPN is providing me 3 vlans in total to carry their services:

  • vlan 4 = iTV
  • vlan 5 = Telephony (which I don’t use)
  • vlan 6 = Internet

So, for iTV we are going to work with vlan 4. Let’s make up a summary about the steps I did:

  • Make up vlan 4 connectivity on the wan-port of my FortiGate
  • enable DHCP client (with options)
  • create the neccesary routing
  • configure the internal interface for the TV-receivers
  • configure policy-rules
  • set some global parameters
  • enjoy iTV via the FortiGate 🙂

Step 1: Create vlan 4 connectivity

First, I configured the wan-interface of my FortiGate with vlan 4 as a subinterface. The code for this is displayed below.

config system interface
    edit "vlan4"
        set vdom "root"
        set mode dhcp
        config client-options
            edit 1
                set code 60
                set type string
                set value "IPTV_RG"
        set distance 10
        set alias "KPN iTV"
        set dns-server-override disable
        set interface "wan1"
        set vlanid 4

Please mention the dhcp client-options part; this is mandatory because KPN will not give you an (valid) IP address when this client-option is not present in your DHCP-request. Option 60 needs to be present in your DHCP request, and the value must exact be IPTV_RG.

If everything is configured well, you should be able to get an IP address at this point. I got an 10.x.x.x address out of a /22 subnet. I also retrieve a DNS-server and a default gateway. To not distort the default-route which is currently active in my FortiGate for internet, I gave this default-gateway a higher distance of 10 (the default-gateway I retrieved for internet has a distance of 5). Another option is to disable the retrieval of the default-gateway at all on this interface.

Step 2: create the necessary routing

What we now need to do, is to take care that the correct routing is applied for the subnet on which the iTV services reside on the KPN network. For KPN the iTV services are located in subnet, so we need to make sure that this subnet is routed correctly to the vlan 4 interface. For this to accomplish, we can do this with another DHCP client option on where KPN will return the routing-information back to the FortiGate. For now, I didn’t get this working. So I decided to configure another method, which was also very easy to implement.

As we have a dynamic address (DHCP) on the vlan 4 interface, I configured a static route where the next-hop address is dynamically determined through DHCP. See my example below.

As you can see above, the next-hop is dynamically determined through DHCP.

Step 3: Configure the internal interface for the TV-receivers

In my home network, I created vlan 5 with subnet for the network where my TV-receivers live. I configured my interface as follows:

config system interface
    edit "vlan5"
        set vdom "root"
        set ip
        set allowaccess ping
        set alias "tv-receivers"
        set interface "internal"
        set vlanid 5

I also enabled a DHCP server function in vlan 5, so that the TV-receivers get an IP address automatically. I specified the internet nameservers of KPN.

Step 4: Configure policy-rules

Because traffic for iTV is actually multicast traffic, we need to configure an inbound- and outbound multicast policy rule so that multicast-traffic is permitted to flow thorough the firewall. With this rules, source-natting is only required for outbound traffic; for inbound traffic, we can disable source-natting. My multicast rules are configured as follows. Mention the SNAT part of the rules.

the multicast policy-rules for iTV traffic

After configured the part above, you should be able to startup a receiver in the internal vlan. It gets an IP address, starts up, but it will get stuck on 85%…

Well, the problem with this is that the receiver also need some internet-access such as DNS, NTP and Netflix traffic. For this I configured a policy-rule, where I allow access to the internet.

After I configured these rules, the receiver starts successfully.

Step 5: Set some global-settings

At this point, you should be able to watch TV via your TV receiver. But it is possible that the screen is constantly “freezing”. This problem can easily be solved by entering the following command on the CLI.

config system settings
    set multicast-ttl-notchange enable

Step 6: Replay and Recordings

In my case, I noticed that replay and recordings did not work yet at this point. While recordings are actually an RTSP stream, I decided to disable the session-helper for RTSP traffic. For one or another reason, a FortiGate do not handle the RTSP traffic well.

In de default configuration, the RTSP session-helper has ID 6. So deleting this ID actually deletes the RTSP session-helper.

    edit 6
        set name rtsp
        set protocol 6
        set port 554

config system session-helper
FGT60F (session-helper) # delete 6
FGT60F (session-helper) # end

That’s all folks, everything should be working fine now! If you experience any issues, please drop a comment.