Technical Tip: How to block the IGMP protocol using a local in policy

carlosaleman · ‎10-25-2023

Description

This article describes how to block the IGMP protocol using a local in policy.

Scope

FortiGate 6.0 and above.

Solution

If it is necessary to block a specific protocol when it reaches a FortiGate interface without needing to know the port used, follow this method.

The IGMP protocol will be blocked in this example.

First, create a custom firewall service:

config firewall service custom

edit IGMP

set category "Network Services"

set protocol IP

set protocol-number 2

Find a list of protocols and their corresponding numbers in the FortiGate handbook.

After, it will only be necessary to create the local in policy using the new custom service:

config firewall local-in-policy

edit 1

set intf wan1

set srcaddr all

set dstaddr all

set service IGMP

set schedule always

set action deny

This method can be used to block some other protocols as well.

Note:

In FortiGate V7.6.0 and above, the Local-in-Policy can be found in the GUI itself.

Select Policy & Objects -> Local-In-Policy -> Create New.
Select all the options required and, in the service, select IGMP.