Technical Tip: Chromecast across subnets

Description
This article describes how to allow traffic from client device to Chromecast and vice versa.

Solution
Chromecast uses a set of protocols including DIAL, mDNS, SSDP and HTTP.
This usually works well on the same subnet, however when using different subnets and a FortiGate, the traffic will need to be allowed and NAT’ed.
The FortiGate needs to be configured to forward multicast packets and to not change the TTL.

# config system settings
    set multicast-ttl-notchange enable
    set multicast-forward enable
end

In this example, the following parameters are used:

1) Lan interface which includes a wifi SSID where the Chromecast is connected: Subnet 192.168.1.0/24
2) Internal5 interface where a PC with Chrome Browser is installed: Subnet 192.168.2.0/24

Create a custom address for SSDP multicast address:

# config firewall multicast-address
    edit "SSDP"
    set start-ip 239.255.255.250
    set end-ip 239.255.255.250
end

Configure the Multicast Policies:

# config firewall multicast-policy
    edit 1
        set srcintf "lan"
        set dstintf "internal5"
        set srcaddr "all"
        set dstaddr "Bonjour" SSDP"
        set snat enable
    next
    edit 2
        set srcintf "internal5"
        set dstintf "lan"
        set srcaddr "all"
        set dstaddr "Bonjour" "SSDP"
        set snat enable
    next
end

Note: “Bonjour” multicast address object is created by default on the FortiGate and the IP address used is the same as mDNS (224.0.0.251).

Custom port ranges can be configured to restrict the traffic to the Chromecast devices.

# config firewall service custom
edit "Chromecast UDP ports"
        set udp-portrange 32768-61000
    next
    edit "Chromecast HTTP ports"
        set tcp-portrange 8008-8009
    next
end

As well, one can create address objects for the Chromecast device and the PC VLAN:

# config firewall address
    edit "ChromecastDevice"
        set subnet 192.168.1.15 255.255.255.255
    next
    edit "PC_Subnet"
        set subnet 192.168.2.0 255.255.255.0
    next
end

Finally, the IPv4 policies for communication across subnets have to be created:

# config firewall policy
    edit 1
        set name "CC to PC_Subnet"
        set srcintf "lan"
        set dstintf "internal5"
        set srcaddr "ChromecastDevice"
        set dstaddr "PC_Subnet"
        set action accept
        set schedule "always"
        set service "Chromecast UDP ports" "Chromecast HTTP ports"
        set nat enable
    next
    edit 2
        set name " PC_Subnet to CC "
        set srcintf "internal5"
        set dstintf "lan"
        set srcaddr "PC_Subnet"
        set dstaddr "ChromecastDevice "
        set action accept
        set schedule "always"
        set service "Chromecast UDP ports" "Chromecast HTTP ports"
        set nat enable
    next
end

Now, the PC on another subnet should be able to cast to the Chromecast located on the other subnet.

Troubleshooting

Make sure no device in between is dropping multicast packets or has IGMP enabled. The Multicast packets should be coming to the FortiGate whenever the “Cast” button of Chrome is used. These packets can be sniffed using following command:

# diagnose sniffer packet internal5 “host 224.0.0.251” 4 0 l