Symptom

In specific cases, the built or teardown syslog messages for multicast connections are not generated. In the below example, the inside is the ingress, and outside is the egress interfaces for the UDP multicast stream: Case 1 - No connection built syslog message is generated The following events take place: 1. A new connection is created between the inside and the identity interfaces, where identity is the internal control plane interface in the firewall: Jan 30 2023 11:26:10: %ASA-6-302015: Built inbound UDP connection 1131 for inside:X.X.X.100/56903 (192.0.2.100/56903) to identity:230.1.1.1/1234 (230.1.1.1/1234) 2. In the same second, a multicast connection between the inside and outside interfaces is torn down: Jan 30 2023 11:26:10: %ASA-6-302016: Teardown UDP connection 1132 for outside:230.1.1.1/1234 to inside:X.X.X.100/56903 duration 0:00:00 bytes 5264 At step 2, there is a teardown message for connection 1132, but there's no built message. Case 2 - No connection built or teardown syslog messages are generated The output of the show conn or show conn all command shows the UDP stream to the identity interface. asa# show conn all 11 in use, 14 most used <========== 11 connections in use IGMP inside X.X.X.11 NP Identity Ifc 224.0.0.251, idle 0:01:57, bytes 16, flags UDP inside X.X.X.11:51699 NP Identity Ifc 230.1.1.1:1234, idle 0:00:00, bytes 0, flags - <====== UDP multicast stream The output of the show local-host command shows the multicast connections between the inside and outside interfaces: asa# show local-host Interface inside: 4 active, 5 maximum active local host: , local host: , local host: , local host: , Conn: UDP outside 230.1.1.1:1234 inside X.X.X.11:51699, idle 0:00:00, bytes 4423076, flags - <=========== Interface outside: 3 active, 5 maximum active local host: , local host: , local host: , Conn: UDP outside 230.1.1.1:1234 inside X.X.X.11:51699, idle 0:00:00, bytes 4423076, flags - <=========== Interface nlp_int_tap: 1 active, 2 maximum active If the connection from X.X.X.11 to 230.1.1.1 is built or terminates, there are only messages related to the multicast connection shown in the output of the show conn all command: Jan 30 2023 15:04:17: %ASA-6-302015: Built inbound UDP connection 8665 for inside:X.X.X.11/51699 (X.X.X.11/51699) to identity:230.1.1.1/1234 (230.1.1.1/1234) Jan 30 2023 15:05:24: %ASA-6-302016: Teardown UDP connection 8665 for inside:X.X.X.11/51699 to identity:230.1.1.1/1234 duration 0:01:07 bytes 0

Conditions

First seen when all of the conditions are in place: 1. ASA/FTD is configured with multicast routing and is part of the source tree (SPT). 2. The igmp static-group command is configured under one or more data interfaces that have the pim neighbor-filter command. The pim neighbor-filter command prevents the establishment of PIM adjacency on that interface: For example: asa# show run int g0/0 ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address X.X.X.1 255.255.255.0 pim neighbor-filter pim igmp static-group 230.1.1.1 asa# show run access-list pim access-list pim standard deny host X.X.X.2 access-list pim standard permit any4

Workaround

None.

Further Problem Description