Use a FortiGate with KPN interactive TV (part 2)

After I got my internet connection from KPN rolling through my FortiGate, the next step was to make interactive TV (iTV) working through my FortiGate as well.

Well, it was a bit of a puzzle to get this working, because of some special settings which are needed for iTV. But when all these things are set, iTV works (almost*) perfectly through the FortiGate.

So why almost* do you think? Well, after testing for a while, it seems that I have a problem with my Internet performance when I have 2 TV receivers active. When both receivers are active, they are using for about ~7-8 Mbps of bandwidth each. So, when 2 receivers are active, I only keeps several Mbits of internet speed left…(I have a 200/200 Mbps contract, which I can easily utilize for 100% when only 1 or no receivers are active). It seems to me that the multicast stream of 2 receivers is a bit to much for my FortiGate 60F.

I decided to route the TV traffic via a dedicated router, and that worked fine! Now I can fully utilize my internet connection even when both receivers are active. In my opinion, separating TV traffic through a dedicated router is the best solution. My router is a Mikrotik RB750Gr3.

This post describes the situation where all traffic is routed through the FortiGate. The situation where I route multicast TV traffic though a dedicated MikroTik router, will be described in a later post.

What do I have?

• Internet from KPN (dutch ISP) with FTTH (Fiber-to-the-home) 200/200 Mbps
• Interactive-TV from KPN
• I do not use telephony from KPN
• Experia box V10A from KPN
• FortiGate 60F (FortiOS 6.4)
• Internal switch where I can do some vlan-stuff with

You MUST use FortiOS 6.4 for this to work. Otherwise, the DHCP-client option which is used for iTV cannot be configured as this option is only available in FortiOS 6.4.

What did I want to realize?

I do not want to use the Experia box of KPN! I want to use my own FortiGate firewall to take over all the functions of the Experia box (apart from WiFi, where I have my own access-points)

What are the topics?

The topics to build are:

• Internet-connectivity (IPv4 & IPv6) (see post part 1)
• iTV including replay and recordings (this post, part 2)

Building iTV

My ISP-connection is delivered over fiber, which is delivered with an UTP-connection from the NTU. The UTP cable is going directly into the WAN-port of my FortiGate.

Good to know is that KPN is providing me 3 vlans in total to carry their services:

• vlan 4 = iTV
• vlan 5 = Telephony (which I don’t use)
• vlan 6 = Internet

So, for iTV we are going to work with vlan 4. Let’s make up a summary about the steps I did:

• Make up vlan 4 connectivity on the wan-port of my FortiGate
• enable DHCP client (with options)
• create the neccesary routing
• configure the internal interface for the TV-receivers
• configure policy-rules
• set some global parameters
• enjoy iTV via the FortiGate 🙂

Step 1: Create vlan 4 connectivity

First, I configured the wan-interface of my FortiGate with vlan 4 as a subinterface. The code for this is displayed below.

config system interface
    edit "vlan4"
        set vdom "root"
        set mode dhcp
        config client-options
            edit 1
                set code 60
                set type string
                set value "IPTV_RG"
            next
        end
        set distance 10
        set alias "KPN iTV"
        set dns-server-override disable
        set interface "wan1"
        set vlanid 4
    next
end

Please mention the dhcp client-options part; this is mandatory because KPN will not give you an (valid) IP address when this client-option is not present in your DHCP-request. Option 60 needs to be present in your DHCP request, and the value must exact be IPTV_RG.

If everything is configured well, you should be able to get an IP address at this point. I got an 10.x.x.x address out of a /22 subnet. I also retrieve a DNS-server and a default gateway. To not distort the default-route which is currently active in my FortiGate for internet, I gave this default-gateway a higher distance of 10 (the default-gateway I retrieved for internet has a distance of 5). Another option is to disable the retrieval of the default-gateway at all on this interface.

Step 2: create the necessary routing

What we now need to do, is to take care that the correct routing is applied for the subnet on which the iTV services reside on the KPN network. For KPN the iTV services are located in subnet 213.75.112.0/21, so we need to make sure that this subnet is routed correctly to the vlan 4 interface. For this to accomplish, we can do this with another DHCP client option on where KPN will return the routing-information back to the FortiGate. For now, I didn’t get this working. So I decided to configure another method, which was also very easy to implement.

As we have a dynamic address (DHCP) on the vlan 4 interface, I configured a static route where the next-hop address is dynamically determined through DHCP. See my example below.

As you can see above, the next-hop is dynamically determined through DHCP.

Step 3: Configure the internal interface for the TV-receivers

In my home network, I created vlan 5 with subnet 10.5.1.0/24 for the network where my TV-receivers live. I configured my interface as follows:

config system interface
    edit "vlan5"
        set vdom "root"
        set ip 10.5.1.1 255.255.255.0
        set allowaccess ping
        set alias "tv-receivers"
        set interface "internal"
        set vlanid 5
    next
end

I also enabled a DHCP server function in vlan 5, so that the TV-receivers get an IP address automatically. I specified the internet nameservers of KPN.

Step 4: Configure policy-rules

Because traffic for iTV is actually multicast traffic, we need to configure an inbound- and outbound multicast policy rule so that multicast-traffic is permitted to flow thorough the firewall. With this rules, source-natting is only required for outbound traffic; for inbound traffic, we can disable source-natting. My multicast rules are configured as follows. Mention the SNAT part of the rules.

After configured the part above, you should be able to startup a receiver in the internal vlan. It gets an IP address, starts up, but it will get stuck on 85%…

Well, the problem with this is that the receiver also need some internet-access such as DNS, NTP and Netflix traffic. For this I configured a policy-rule, where I allow access to the internet.

After I configured these rules, the receiver starts successfully.

Step 5: Set some global-settings

At this point, you should be able to watch TV via your TV receiver. But it is possible that the screen is constantly “freezing”. This problem can easily be solved by entering the following command on the CLI.

config system settings
    set multicast-ttl-notchange enable

Step 6: Replay and Recordings

In my case, I noticed that replay and recordings did not work yet at this point. While recordings are actually an RTSP stream, I decided to disable the session-helper for RTSP traffic. For one or another reason, a FortiGate do not handle the RTSP traffic well.

In de default configuration, the RTSP session-helper has ID 6. So deleting this ID actually deletes the RTSP session-helper.

    edit 6
        set name rtsp
        set protocol 6
        set port 554

config system session-helper
FGT60F (session-helper) # delete 6
FGT60F (session-helper) # end

That’s all folks, everything should be working fine now! If you experience any issues, please drop a comment.