Wifi Enabled Smart Lighting - LIFX

[dave_macdonald]

Hi, (apologies for the long post)

Background info: I am a novice when it comes to Firewalls and even newer to Fortinet. Our office has a FortiGate 200E firewall. We have a need to set up a couple Wifi Enabled Smart Lighting bulbs and running into an issue where the Firewall is not allowing LIFX to pass through to register with their cloud server (v2.broker.lifx.co).  

We've determined that the bulbs are not the issue as they work on a home network as well as a mobile hotspot. Here is what Lifx support suggests:

"Ok. It might be easier, if possible, to just activate UPnP, or allow LAN connections on the whole, during setup of the lights. Technically, we do not support the enterprise style network you are connecting to, so I can help to the best of my ability, but it's clear the issue is with a router configuration, not with the light, or app. The cool part is, once cloud connected, LAN is not necessary, so you can turn off those router settings once setup is complete."

Seeing as how Fortinet doesn't support UPnP I contacted Fortinet via chat and was recommended to create a security policy and was sent the instructions.  I've followed them and created a Service and opened up the requested ports (56700 UDP & TCP) as well as creating a Policy under the IPv4 but still no luck in getting the app to properly register the device to allow control as intended. However, the device is being added to our network and I can see it getting an IP Address.  Please ask all the probing questions you need, apologies if my question is confusing.

any assistance would be greatly appreciated. 

Thanks for your help.

[EMES]

Because Fortinet does not support UPNP, I think you have to NAT the traffic statically. Either enforce DHCP to give the lights the same IP address or make them static if possible. Then try using that same policy you created and set the source to one light. Also tick the fixed port option so the source port does not change. Sometimes with devices that require UPNP (XBOX,Playstation) then this works but some options don't work 100%. So the next option would be NAT the traffic inbound but because the company probably uses random IPs if its hosted in amazon you cant narrow down the source IPs for the inbound NAT(VIP). You can move the lights onto a seperate subnet entirely to seperate them from your Inside traffic, to minimize risk. The last part is speculation depending on how the device communicates outbound or inbound.

[dave_macdonald]

Thank you! I will give this a shot and post back here on how it goes. 

appreciate the quick response

[dave_macdonald]

Still no luck, we are running into the same problem. 

any additional assistance would be great. 

Thank you