Forward Broadcast

[HS08]

Hello

I have fortigate firewall and i have 2 vlan. Let say vlan100 for NAS and vlan200 for cctv.

The cctv can connect to the nas only if cctv and nas located in same subnet, the cctv can't discover the nas if the nas located in different subnet. Can we make some forward broadcast to enable the cctv can discover nas even in different subnet?

[funkylicious]

yes,

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-FortiGate-forward-broadca...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Forwarding-IP-broadcast-to-a-different-net... 

[HS08]

Trying to follow the article but no success, in the VIP hit count always 0.

Looking in the local log i got this 

Application Name	netbios forward
Category	unscanned
Protocol	17
Service	udp/137

Action	deny
Policy Type	Local IPv4

[funkylicious]

please post the whole output of the deny log.

also, please provide more info about your setup, with specific interface/network allocation and the relevant policy and vip configuration.

[HS08]

My CCTV under VLAN 200 (port3), NAS under VLAN 100 (port2).

VLAN 200 cnfiguration

==================

edit "VLAN200"
set vdom "root"
set ip 10.18.120.1 255.255.255.0
set allowaccess ping
set broadcast-forward enable
set device-identification enable
set role lan
set snmp-index 44
set interface "port3"
set vlanid 200

port2 config

========================

edit "port2"
set vdom "root"
set ip 10.18.100.1 255.255.255.0
set allowaccess ping https http ftm
set type physical
set alias "TO_NAS"
set snmp-index 4
next

Vip config

================

edit "FWD-BROADCAST"
set uuid f47bc3ec-4be2-51f0-d7bb-636bb963c2ff
set extip 10.18.120.255
set mappedip "10.18.100.255"
set extintf "VLAN200"
next

Firewall policy

===========================

edit 20
set name "LAN TO LAN"
set uuid fc85aeb4-4a88-51f0-bb96-3f685c8e31d1
set srcintf "port2" "VLAN-110" "VLAN-140" "VLAN200" "loopback"
set dstintf "port2" "VLAN-110" "VLAN-140" "VLAN200" "loopback"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
next

and here the log

Source	10.18.120.122
Source Port	20,733
Source Country/Region	Reserved
Primary Source Mac	98:de:72:86:f2:4d
Device	camera_061a03
Source Interface	VLAN200
Host Name	camera_061a03
OS Name	Android

Destination	111.x.x.x
Destination Port	13,926
Destination Country/Region

Application Name	udp/13926
Category	unscanned
Protocol	17
Service	udp/13926

Received Bytes	0 B
Received Packets	0
Sent Bytes	0 B
Sent Packets	0

Action	deny
Threat	262,144
Policy Type	Local IPv4

Level	notice
Threat Level	Low
Threat Score	5

Log event original timestamp	1750247113805096700
Timezone	+0700
Log ID	0001000014
Type	traffic
Sub Type	local
Source Interface Role	lan
Destination Interface Role	undefined
Source Server	0