UDP across privat subnets

[LGSONE]

OK, first post here. Pretty syc' d to get this new gear up and running. UPS delivered a 90DPoE, 320C and 221C just today so its not even out of the box yet. N00b alert so please bear with me. Here is my issue: Here is the problem, I work with a lot of commercial Audio Video gear and some of the vendors do UDP broadcasts for discovery of their hardware, both for initial config and for programming updates. Well, I have run out of IP' s on my AV network and segmenting the WLAN and LAN to allow for expansion is needed. Problem is most of the control interfaces, remote, touch panels are wireless and are now going to be on the WLAN private 10.2.2.0 subnet with the controller(s) on the 10.2.1.0 subnet. To top it off some of the control interfaces are Apple iPads, Touch' s, etc and they need to " Airplay" / multicast to the LAN. So it is a two part problem. I have done a TON of reading and mDNS, IP Directed broadcast, IP helper seems to come up quite a bit. Many threads are talk about the DHCP relay UDP broadcasting across subnets and this " seems" to be what I need but with configurable ports specific to the controller / control interfaces. Our rep sent me this: config system interface edit <interface> set netbios-forward enable set wins-ip <wins_server_ip> end This is for a WINS server, how can I create a template for a AV Automation controller. For directed broadcasts (i.e. a packet destined for a foreign IP subnet which would be addressed to that subnet' s broadcast IP address and sent out as a broadcast by the last hop in the routing path) - that’s accomplished with: config system interface edit <interface> set broadcast-forward enable end So, I' ll have this up and running this eve and I am wondering if this will work for the UDP discovery and reply across subnets. As far as AirPlay goes, that is multicast so I really don' t know if these will work but I have not done as much reading on this. I' m ditching a UBNT ERL device because this is not possible. I have wire shark' d the discovery process and have my source and destination ports but how do I configure that if I even need to with the above commands. So after installation, firmware upgrading and registering for UTM services, and setup of a basic network config with a single wan port and the two subnets I' ll be trying this. Any one had this requirement. It is becoming more and more of an issue on projects and I' m told the FortiNet gear can handle this. Why in this day and age this type of discovery is still used for static addressed control equipment is beyond me. I think the vendor want to make it as dummy proof as possible, who knows but in the last year it has become more and more of an issue. Any input would be great. Thank you, LGSONE

[oscarcamacho]

Hi Lance, It seems that all you are missing are multicast policies, which by default on NAT mode there' s an implicit deny. Protocols like Bonjour which is used by AirPlay and systems other than Apple' s, use multicast for discovery and then unicast traffic is send for the streaming. You need to configure multicast policies through a different policy set, you can do it by cli " config firewall multicast-policy" and the objects on " config firewall multicast-addresss" . If you want this configuration on the GUI you need to enable it on System-> Config-> Features, click on " show more" at the bottom and set " Multicast Policy" ON. This way you will have the Multicast option under Policy-> Policy What' s most important to create a multicast policy is the destination address (224.0.0.0 through 239.255.255.255) and the destination interface(s) where you want it to be send. You can check an basic example for AirPlay on the FortiGate v5.0 Cookbook (page 109 printed, 115 pdf): http://docs.fortinet.com/d/fortigate-the-fortigate-cookbook-5.0.5