In transparent mode, FortiGate works as a Layer 2 bridge. By default, interfaces and VLANs are part of forwarding domain 0. If multiple interfaces are part of the same forwarding domain, traffic can be bridged between those interfaces depending on MAC learning and the Layer 2 topology.
When traffic is expected to pass only between two specific interfaces, but it is observed on additional interfaces, verify the forwarding domain configuration.
Confirm where the traffic is observed.
Run a sniffer for the affected source and destination:
diagnose sniffer packet any 'host <source_IP> and host <destination_IP>' 4 0 l
With verbosity level 4 or higher, the sniffer output shows the interface where the packet is observed.
The purpose of this step is to confirm whether traffic for the same source and destination is observed on more than two interfaces.
Example scenario:
Traffic is expected only between port23 and port24. However, the sniffer also shows traffic for the same source and destination on port15 or port16.
In this case, validate the forwarding domain configuration because the interfaces may be part of the same Layer 2 bridge domain.
Verify the forwarding domain assigned to the involved interfaces.
Run:
show system interface
Review the following settings under the involved interfaces:
set forward-domain <id>
Example of current configuration:
config system interface
edit port23
set forward-domain 60
next
edit port24
set forward-domain 60
next
edit port15
set forward-domain 60
next
edit port16
set forward-domain 60
next
end
In this example, port23, port24, port15, and port16 belong to the same forwarding domain. Therefore, those are part of the same Layer 2 bridge domain.
If traffic is expected to be isolated only between port23 and port24, port15 and port16 should not remain in the same forwarding domain. Move the unrelated interfaces to a different forwarding domain.
Display forwarding domain information.
Run:Â
diagnose netlink brctl domain <bridge_name> <forward_domain_id>
Example:
diagnose netlink brctl domain root.b 60
Use this output to confirm which interfaces are members of the selected forwarding domain.
Adjust the forwarding domain if traffic must be isolated.
Example of adjusted configuration:
config system interface
edit port23
set forward-domain 60
next
edit port24
set forward-domain 60
next
edit port15
set forward-domain 61
next
edit port16
set forward-domain 61
next
end
After this change, port23 and port24 remain in forwarding domain 60, while port15 and port16 are moved to forwarding domain 61. Traffic from forwarding domain 60 will not be bridged to forwarding domain 61.
Validate after the change.
Run the sniffer again:
diagnose sniffer packet any 'host <source_IP> and host <destination_IP>' 4 0 l
Confirm that the same traffic flow is now observed only on the expected interfaces.
If traffic is still observed on unexpected interfaces, review the external Layer 2 topology, VLAN configuration, STP, switch MAC table, broadcast traffic, unknown unicast traffic, or any alternate Layer 2 path outside FortiGate.
Conclusion:
When FortiGate is operating in transparent mode and traffic for the same source and destination is observed on more interfaces than expected, review the forwarding domain configuration.
Interfaces in the same forwarding domain are part of the same Layer 2 bridge domain. Therefore, traffic may be observed on other interfaces that belong to that same forwarding domain. To isolate traffic to a specific group of interfaces, place only those interfaces in the same forwarding domain and move unrelated interfaces to another forwarding domain.
Related documents: Transparent mode Checking the bridging information in transparent mode Forwarding domains in transparent mode Forward-domain solution Performing a sniffer trace or packet capture | 
