Airplay over Mobility Controller MSM760 in access control mode not working - Multicast DNS block

[Thutmose]

Question:

How may we use our Apple TV devices over a VSC in “Access control” mode

in a Mobility Controller MSM760 Teaming Evironment  (Passthrough: Airplay, Bonjour, Multicast DNS)?

Scenario:

• Mobile Devices  iPads and iPhones
• AccessPoints HP MSM460 in controlled mode
• Mobility Controller HP MSM760
• Teaming Mode (2 Controller)
• Software version: 5.7.2.0-sr2-12993
• Internet-Port with  Egress VLAN (113) in the Internet Segment
• Apple TV’s are connected by cable in the Egress VLAN (113)
• Apple TV  uses  Airplay service (see below)
• Internet-Port has
• untagged Management VLAN
• several  tagged Egress VLANs

Airplay:

• Streaming music and video …
• Propagation by Airplay with Apples  Bonjour Service
• Which use  Multicast DNS (mDNS) protocol
• IP 224.0.0.251 and UDP Port 5353

Problem:

• Before change to „Access control“ Apple TV access was fine
• After change to „Access control“ (tunnelmode)  no access!
• iPhones and iPads can’t see any Apple TV device
• Airplay don’t work - Broad-/Multicasts blocked!?!

Analyses/Tests:

• Team --> Security --> Firewall --> Firewall --> None = no success
• IGMP proxy enabled under Team à Team à Network
• No success
• Makes no sense – client and server in same segment (VLAN)
• IGMP proxy already disabled
• VSC die „Wireless security filters” toggled = no success
• Broadcast Filtering is off

In the CLI we see TX errors on Controller data tunnel

CLI# show interfaces

Interface                   State  Dir          Bytes          Packets    Dropped    Errors    Collisions

--------------------------- -----  ---- -------------------- ---------- ---------- ---------- -----------

Controller data tunnel       Up    Rx:             413321614     336459          0          0

                                   Tx:              44123686     161033          0      13087           0 ß

Has anyone an idea?

[Fredrik Lönnman]

Make sure you dont have any multicast or broadcast restrictions on the VSC and that the wireless and wired devices are in the same l2 segment, since bonjour cant be routed.

[Thutmose]

@Fredrik Lönnman

There are none broadcast filter and wireless filter and global firewall switched on.

All components are connected to the same VLAN (L2 segment) - see above.

The mDNS (Bonjour) blocking starts with the change to "access control" mode,  why?

The "access control" mode is necessary for operations in remote sites,

if you have no access to remote Access WAN Routers for building VRFs and

GRE tunnels or alternatively L2TPv3 tunnels.  This methods need great effort.

With regards

Johannes

[Fredrik Lönnman]

Then I dont really know. All access controller environment Ive set up have been routed in the MSM controller, which instantly disables bonjour. But yours are bridget? Are you able to get through other kind of multicast?

[Thutmose]

Yes - it seems, that in "access control" mode the traffic will be bridged over
br0 on the LAN-Port. Under CLI we detected some TX errors - see above.
 
It seems no multi-/broadcasts are passing after changing to "access control"
mode.

Other diagnostic Apps reports several neighbors before the change,
now the App sees only clients connected to the same wireless access point!

[LasseT]

sorry about replying this old post, but have you got working this airplay problem? We have same situation and need some quick solution for this.

[Henrick_Almqvis]

In VSC config for your SSID, under "Virtual AP" have you allowed traffic between client? It´s configured to "no" by default.

[DougB-CCCP]

A long time ago there was a solution for AirPlay that involved setting the QoS for the VSC to "VSC-Based Normal" instead of "Diffserv".  Give that a try.