Multicast processing and basic Multicast policy
You need to add firewall policies to allow packets to pass from one interface to another. Multicast packets require multicast security policies. Similar to firewall policies, in a multicast policy, the administrator specifies the source interface, destination interfaces, the allowed source address ranges, and destination addresses of the multicast traffic. You can also use multicast policies to configure source NAT and destination NAT for multicast packets.
Multicast forwarding in NAT mode
multicast-forward is enabled, the FortiGate forwards any multicast IP packets in which the TTL is 2 or higher to all interfaces and VLAN interfaces except the receiving interface. The TTL in the IP header is reduced by 1. Even though the multicast packets are forwarded to all interfaces, you must add multicast policies to allow multicast packets through the FortiGate.
multicast-forward is disabled, then FortiGate unit drops packets that have multicast source or destination addresses.
In NAT mode, there is a per-VDOM configuration to disable forwarding any multicast traffic. This command is only available in NAT mode.
config system settings set multicast-forward <disable|enable(default)> end
You can also use the
multicast-ttl-notchange option so that FortiGate doesn't increase the TTL value for forwarded multicast packets. Use this option only if packets are expiring before reaching the multicast router.
config system settings set multicast-ttl-notchange enable end
Multicast processing in TP mode
multicast-skip-policy is enabled, no check is performed based on multicast policy. A multicast packet received on an interface is flooded unconditionally to all interfaces (except the incoming interface) belonging to the same forwarding domain. Multicast packets are forwarded even when there is no multicast policy or the multicast policy is set to deny. To forward multicast traffic based on multicast policy,
multicast-skip-policy must be disabled.
In transparent mode, there is a per-VDOM configuration to skip policy check and forward all multicast traffics. This command is only available in transparent mode.
config system settings set multicast-skip-policy <disable(default)|enable> end
To allow RIP2 packets from port1 to port2 using the GUI:
- Go to Policy & Object > Multicast Policy.
- Click Create New.
- For Incoming Interface, select port1.
- For Outgoing Interface, select port2.
- For Source Address, select 10.10.0.10/32.
- For Destination Address, select RIPv2.
- Click OK.
To allow RIP2 packets from port1 to port2 using the CLI:
config firewall address edit "10.10.0.10/32" set subnet 10.10.0.10 255.255.255.255 next end config firewall multicast-address edit "RIPv2" set start-ip 18.104.22.168 set end-ip 22.214.171.124 next end config firewall multicast-policy edit 2 set srcintf "port1" set dstintf "port2" set srcaddr "10.10.0.10/32" set dstaddr "RIPv2" next end