Technical Tip: How to enable STUN protocol in policy

[nnair]

Description	This article describes how to enable the STUN protocol in a policy.
Scope	All versions of FortiGate. FortiGate must be in Profile-Based Mode (with or without Central SNAT enabled).
Solution	By default, the STUN option is hidden in policies. To enable the hidden policy: config firewall policy     edit 1         set action accept         set nat enable         set permit-any-host disable         set permit-stun-host disable end After enabling the NAT and setting the policy action to 'accept', it will be possible to see the STUN option on the same policy. See the screenshots below. Without the NAT enabled and without a set action: After enabling the NAT and setting the action to 'accept'. Note: When this command is used in the firewall policy 'set permit-any-host enable', the FortiGate firewall will accept UDP natted packets from any host.  Hence, to be more specific with STUN, define 'set permit-stun-host enable' in the firewall policy, which accepts UDP packets from any Session Traversal Utilities for NAT (STUN) host.