The Multicast Policy GUI page has been updated from previous versions of the firmware to the new GUI look and feel. Some functionality has also been changed.
The DNAT option has been removed from the GUI but is still in the CLI.
To create/edit a multicast policy go to Policy & Objects > Multicast Policy. The Listing window on the right will have buttons along the top that will enable you to l Create New l Edit l Delete
There is also a Search field that will allow you to search or filter the available policies if you have a lot of them.
To configure a new policy left click on the Create New button. This will reveal the New Policy editing window.
- Using the drop down menu, fill in the field for Incoming Interface. Only one interface can be chosen.
- Using the drop down menu, fill in the field for Outgoing Interface. Only one interface can be chosen.
- Set the Source Address parameter by selecting the field with the “+” next to the field label. When the field is selected a window will slide out from the right. In order for a multicast address to available for selection, the address object needs to have been created already. Only useable address options will be available for selection. This means only mutlticast address objects and the more generic all and none The “+” icon next to the Search field is a shortcut for creating a new firewall object. Single or multiple options can be selected unless the all option is chosen in which case, it will be the only option.
- Set the Destination Address parameter by selecting the field with the “+” next to the field label. This field is similar to the Source Single or multiple options can be selected unless the all option is chosen in which case, it will be the only option.
- Set the Action This will be to either ACCEPT or DENY the traffic through the policy.
- Toggle the Enable SNAT switch to the setting you want. If the slider is gray the option is disabled. If it is colored, it is enabled.
- Use the drop down menu to select a Protocol. The options are: l Any l ICMP l IGMP
- TCP – includes Port Range fields l UDP – includes Port Range fields
- Other – includes a field for the protocol number
- Depending on which Protocol is defined, the some other fields may appear.
- Port Range – The first field is for the starting value for the port and the second for the ending value for the port range used by the protocol. Both of these values are inclusive.
- Protocol field – This appears when the Other option is chosen. Enter the value of the protocol number for the protocol you wish to use.
- Toggle the Log Allowed Traffic switch to the setting you want. If the slider is gray the option is disabled. If it is colored, it is enabled.
- Toggle the Enable this policy switch to the setting you want. If the slider is gray the option is disabled. If it is colored, it is enabled. By default, this should be enabled
- Click on the OK button to save the policy.
SSL mirroring for policies
You can configure the mirroring of SSL inspected traffic for IPv4 and IPv6 policies in the GUI. To use this option, configure the FortiGate to use SSL deep inspection instead of certificate inspection.
Having trouble configuring your Fortinet hardware or have some questions you need answered? Ask your questions in the comments below!!! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!
Don't Forget To Buy Your Fortinet Hardware From The Fortinet GURU