| When the source IP address of the NetBIOS broadcast belongs to a different subnet than the FortiGate interface, the FortiGate does not recognize the packets as NetBIOS traffic.
Instead, it classifies them as generic UDP broadcast packets.
In this case, the FortiGate ignores the netbios-forward setting and, if allow-traffic-redirect is enabled in the global settings, it may still forward these broadcasts. Example configuration: config system interface edit "port1" set netbios-forward disable next end
Example output: FG6H0F-3 # get system status | grep build Version: FortiGate-600F v7.4.8,build2795,250523 (GA.M) First GA patch build date: 230509 FG6H0F-3 # show system interface port1 config system interface edit "port1" set vdom "root" set ip 172.27.140.51 255.255.255.0 set allowaccess ping https ssh http telnet fgfm set type physical set snmp-index 3 next end FG6H0F-3 # get system global | grep redir admin-https-redirect: enable allow-traffic-redirect: enable ipv6-allow-traffic-redirect: enable FG6H0F-3 # diagnose packet sniffer any 'host 172.27.40.220' 4 0 a 2025-10-23 10:19:11.718055 port1 in 172.27.40.220.137 -> 172.27.40.255.137: udp 30 2025-10-23 10:19:11.718063 port1 out 172.27.40.220.137 -> 172.27.40.255.137: udp 30 2025-10-23 10:19:12.718375 port1 in 172.27.40.220.137 -> 172.27.40.255.137: udp 30 2025-10-23 10:19:12.718382 port1 out 172.27.40.220.137 -> 172.27.40.255.137: udp 30
As shown above, even though the netbios-forward is disabled, the NetBIOS UDP broadcast packets are forwarded out of the same interface because the traffic is redirected under allow-traffic-redirect. Behavior by FortiOS version: FortiOS v7.0.16/v7.2.10/v7.4.4 and later:
FortiGate may forward NetBIOS broadcasts when allow-traffic-redirect is enabled and the source IP is from a different subnet. Earlier FortiOS versions:
When the source IP address is on a different network than the FortiGate interface performing traffic redirection, the traffic must match an IPv4 policy regardless of the allow-traffic-redirect setting. Workaround: Disable traffic redirection globally: config system global set allow-traffic-redirect disable end
Starting from v7.4.10, v7.6.5, v8.0.0 or later, there was a change in default behavior where the default setting for allow-traffic-redirect (and the IPv6-equivalent ipv6-allow-traffic-redirect) is set to disable (in earlier FortiOS versions, the default setting for this was enable) Note: - v5.0 up to v7.0 are out of engineering support. So these commands might be different on higher versions. Consider upgrading the firmware level on the device to a supported version (v7.2 up to v7.6). Check the firmware path and compatibility depending on the hardware on the following link: Upgrade tool.
- Disabling this setting ensures that traffic arriving at an interface and redirected out on the same interface requires a firewall policy to explicitly allow the traffic. For more information, refer to the release notes:
Changes in default behavior.
Related article: Technical Tip: Traffic handled by FortiGate for packets with ingress & egress as same interface | 
