Technical Tip: Using destination interface as 'any' on Multicast policy when FortiGate is acting only as a multicast forwarder

Consider the following diagram:

Based on the diagram, the multicast traffic will reach the FortiGate from the multicast server and will be distributed to clients. This is done using 'block intra-vlan traffic' on VLAN 100, as per the following config.

config system interface

    edit "Vlan100"
        set vdom "root"
        set ip 192.168.100.1 255.255.255.0
        set allowaccess ping
        set device-identification enable
        set role lan
        set snmp-index 30
        set switch-controller-access-vlan enable   <- In the GUI, this is referred to as 'block intra-vlan traffic'.
        set interface "fortilink"
        set vlanid 100
    next

When the traffic reaches FortiGate, a multicast policy is been used to send the traffic to the ingress interface, which is VLAN 100 on FortiLink.

Based on this, the multicast policy should look like the following, where the source and destination interface are the same (VLAN100). However, the same interface is not supported as both source and destination:

config firewall multicast-policy
    edit 1
        set uuid 386da6f4-8c3c-51ef-62b4-4a484a66318c
        set name "v100"
        set logtraffic enable
        set srcintf "Vlan100"
        set dstintf "Vlan100"       <- Not supported.
        set srcaddr "tac" "ubuntu"
        set dstaddr "all"
    next
end

As a workaround, 'any' can be used for a destination interface such as the following:

config firewall multicast-policy
    edit 1
        set uuid 386da6f4-8c3c-51ef-62b4-4a484a66318c
        set name "v100"
        set logtraffic enable
        set srcintf "Vlan100"
        set dstintf "any"       <- Destination has to be changed to 'any'.
        set srcaddr "tac" "ubuntu"
        set dstaddr "all"
    next
end

Note 1: It was also observed that having a specific destination address does not allow traffic to flow. hence it is required to have 'all' as the destination address.

Note 2: In future releases, this behavior may change.

Note 3: Beware that this configuration will flood the multicast traffic received on VLAN100 to all active interfaces. This will result in wasting network bandwidth and resources because the traffic is flooded to interfaces where there are no listeners to the multicast traffic. The administrator may consider changing the behavior and allowing direct intra-VLAN traffic if multicast will be used.