Technical Tip : How to filter multicast traffic based on protocol port range

[gfantappie]

Description

This article explains how to filter multicast traffic for a specific port range to add more granularity to the multicast flows allowed through the FortiGate.

Scope

FortiGate (multicast routing)

Solution

The configuration is done via CLI using the "start-port" and "end-port" settings and it is mandatory to set the protocol; usually for multicast it is "17" (UDP).

# config firewall multicast-policy
# edit <ID>
id                  : <ID>
action: accept
dnat: 0.0.0.0
dstaddr: 0.0.0.0 0.0.0.0
dstintf: <destination interface>
end-port: <end-port>
nat: 0.0.0.0
protocol: 0 <====== to be set to 17
srcaddr: 0.0.0.0 0.0.0.0
srcintf: <source interface>
start-port: <start-port>

If the protocol is not set, the CLI will allow the configuration of the protocol port range, but the option will be deactivated.