Skip to main content
User921
User921
New Member
January 7, 2026
Question

How to allow profinet protocol?

  • January 7, 2026
  • 1 reply
  • 353 views
We want to allow the following protocols between two physical ports with two mac addresses:
"arp || stp || mdns || pn_rt || pn_io_device || pn_io || pn_dcp" (wireshark notation)
 
With FortiOS 7.6.4 we have set the opmode to transparent and created a firewall policy to allow 'ALL' services, but that only lets the first protocols/services (arp || stp || mdns ) through, but blocks the rest (pn_*).
 
Is it possible to fix this in any way, e.g. by creating an IPS Signature for Profinet (--ethertype 0x8892) and adding that to the policy?

The test setup:

    config firewall policy
        edit 2
            set name "Allow all MACs"
            set uuid 6e874ff8-eaee-51f0-5cca-7370b58c116a
            set srcintf "LAN2 and LAN3"
            set dstintf "LAN2 and LAN3"
            set action accept
            set srcaddr "all MAC"
            set dstaddr "all MAC"
            set schedule "always"
            set service "ALL"
            set logtraffic all
        next

where intf "LAN2 and LAN3" is:

    config system zone
        edit "LAN2 and LAN3"
            set intrazone allow
            set interface "lan2" "lan3"
        next
    end

and "all MAC" is :

    config firewall address
        edit "all MAC"
            set type mac
            set macaddr "00:00:00:00:00:00-ff:ff:ff:ff:ff:ff"
        next
    end

1 reply

mpapisetty
Staff
mpapisetty
Staff
January 8, 2026

@User921 ,

Did you try enabling the l2forward option under the interface? 
config system interface
  edit <interface name>
    set l2forward enable
end

 

By default, the ALL is for IP traffic. Profinet does not come under IP but works with different ethertypes. Setting the l2forward should allow the traffic to go through. Let me know how it goes. 

User921
User921Author
New Member
January 8, 2026

Thank you for the suggestion, but it did not solve the issue.

 

We've also tried adding IPS for ethertype 0x8892 (Profinet RT) with Action=Pass, but that also did not help.

 

If we can get the first Profinet Real-Time: DCP (Dynamic Configuration Protocol) identify response, then the rest should follow.

 

Terms & ConditionsAccessibility statement