Description
This article explains how to filter multicast traffic for a specific port range to add more granularity to the multicast flows allowed through the FortiGate.
Scope
FortiGate (multicast routing)
Solution
The configuration is done via CLI using the "start-port" and "end-port" settings and it is mandatory to set the protocol; usually for multicast it is "17" (UDP).
# config firewall multicast-policy
# edit <ID>
id : <ID>
action: accept
dnat: 0.0.0.0
dstaddr: 0.0.0.0 0.0.0.0
dstintf: <destination interface>
end-port: <end-port>
nat: 0.0.0.0
protocol: 0 <====== to be set to 17
srcaddr: 0.0.0.0 0.0.0.0
srcintf: <source interface>
start-port: <start-port> |
If the protocol is not set, the CLI will allow the configuration of the protocol port range, but the option will be deactivated.
