Technical Tip: How to configure OSPF with virtual wire pair interfaces

Routers 1 and 2 exchange OSPF hello packets through the FortiGate virtual wire pair interfaces (port9, port10).

Virtual Wire Pair (VWP) Configuration:

Virtual wire pair

VWP Policy:

By default, FortiGate does not forward multicast traffic. Due to this, OSPF hello packets sent over multicast addresses 224.0.0.5 and 224.0.0.6  will be dropped at the firewall. To configure the multicast forwarding, make sure the multicast policy is enabled. In the GUI, navigate to the System -> Feature Visibility -> Multicast Policy and enable the option.

To enable multicast policy from the CLI, use the following command:

config system setting

    set gui-multicast-policy enable

end

Create a Multicast Policy between VWP Interfaces:

To create the above policies using CLI:

config firewall multicast-policy
    edit 1
        set srcintf  port9
        set dstintf  port10
        set srcaddr  all
        set dstaddr  OSPF <--Built-in  Multicast address object
    next
    edit 2
        set srcintf  port10
        set dstintf  port9
        set srcaddr  all
        set dstaddr  OSPF 
    next

end

OSPF will be established between routers.

Related document:

Configuring multicast forwarding 

Related articles:

Technical Tip: Creating a virtual wire pair

Technical Tip: Virtual Wire Pair (VWP) and connectivity with Non-VWP interfaces

Technical Tip: Virtual wire pairs

Technical Tip: Forwarding multicast traffic in NAT mode