Intra-Zone Multicasting

Hi Team,

You can check this article to enable multi cast forwarding and to prevent changing multcast ttl value

https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/968606/configuring-multicast-forwarding

yeah that describes the way one usually achieves that with :)

But that does not work for zone members. It woukd only work for the zone itself 

plus it does not work intra-zone because of identical source and destination iface since one can only select the zone.

Its a fail-by-design here and also creates security risks....

TAC have confirmed that indeed both FortiManager and FortiGate do lack this feature.

They told us to open a NFR on that probably.

You can allow intra-zone multicast traffic with the following configuration:

config system zone
edit ZoneA
set intrazone allow
end
end 

You can then sent your multicast policy interfaces to any/any and restrict traffic via the source and destination IPs. 

See https://community.fortinet.com/t5/FortiGate/Technical-Tip-Workaround-to-allow-the-multicast-traffic-to-flow/ta-p/203905/redirect_from_archived_page/true

@brandonziots no! This will allow any traffic between zone members without any policies which I consider an even bigger security risk than the above!

With that you have no more chance to regulate traffic between zone members!

Btw I don't know why the forum now shows me as thread starter?! I just replied to the thread....

@brandonziots yes but there is one big difference in here: the standard FGT way is you have to explicitely allow any traffic you want to flow (except from net-iternal traffic). If you allow Intra-Zone-Traffic in a zone you turn that around 180°. In this case any traffic between zone members is allowed except if you forbid it by policy!