FortiGate Broadcast Forwarding

 Problem

In today's time still rare and nevertheless there is the requirement from time to time that broadcast packets must be transported across the subnet boundary.

This example shows how WoL packets can be transported across the subnet boundary.

Solution

The solution is quite simple. The following configuration is necessary on the Fortigate:

Enable Multicast-Policy Feature

config system settings
    set gui-multicast-policy enable
end

Or over GUI

Broadcast Forwarding Configuration

After the Feature is enabled we need the following configuration. The easiest way is to do over CLI:

config firewall multicast-address
    edit Broadcast
        set type broadcastmask
        set subnet 255.255.255.255/32
    next
end

config firewall multicast-policy
    edit 0
        set name "Forward WoL Packet"
        set logtraffic enable
        set srcintf "lan"
        set dstintf "clients"
        set srcaddr "net_192.168.10.0/24" <-- Our Subnet with WoL Sender
        set dstaddr "Broadcast"
    next
end

Over GUI it looks like this:

That's it. :)

Verify

After this easy configuration, let test it:

Without Multicast Policy

# diagnose sniffer packet any 'port 9' 4 0 a
Using Original Sniffing Mode
interfaces=[any]
filters=[port 9]
2022-01-04 13:09:24.498837 lan in 192.168.80.10.44036 -> 255.255.255.255.9: udp 102

As we see, the packet receives the FortiGate but is not forwarded.

With Multicast Policy

# diagnose sniffer packet any 'port 9' 4 0 a
Using Original Sniffing Mode
interfaces=[any]
filters=[port 9]
2022-01-04 13:09:24.498837 lan in 192.168.80.10.44036 -> 255.255.255.255.9: udp 102
2022-01-04 13:09:24.498887 clients out 192.168.80.10.44036 -> 255.255.255.255.9: udp 102