Multicast policy

The Multicast Policy GUI page has been updated from previous versions of the firmware to the new GUI look and feel. Some functionality has also been changed.

The DNAT option has been removed from the GUI but is still in the CLI.

To create/edit a multicast policy go to Policy & Objects > Multicast Policy. The Listing window on the right will have buttons along the top that will enable you to l Create New l Edit l Delete

There is also a Search field that will allow you to search or filter the available policies if you have a lot of them.

To configure a new policy left click on the Create New button. This will reveal the New Policy editing window.

1. Using the drop down menu, fill in the field for Incoming Interface. Only one interface can be chosen.
2. Using the drop down menu, fill in the field for Outgoing Interface. Only one interface can be chosen.

Multicast policy

3. Set the Source Address parameter by selecting the field with the “+” next to the field label. When the field is selected a window will slide out from the right. In order for a multicast address to available for selection, the address object needs to have been created already. Only useable address options will be available for selection. This means only mutlticast address objects and the more generic all and none The “+” icon next to the Search field is a shortcut for creating a new firewall object. Single or multiple options can be selected unless the all option is chosen in which case, it will be the only option.
4. Set the Destination Address parameter by selecting the field with the “+” next to the field label. This field is similar to the Source Single or multiple options can be selected unless the all option is chosen in which case, it will be the only option.
5. Set the Action This will be to either ACCEPT or DENY the traffic through the policy.
6. Toggle the Enable SNAT switch to the setting you want. If the slider is gray the option is disabled. If it is colored, it is enabled.
7. Use the drop down menu to select a Protocol. The options are: l Any l ICMP l IGMP
   • TCP – includes Port Range fields l UDP – includes Port Range fields
   • OSPF
   • Other – includes a field for the protocol number
8. Depending on which Protocol is defined, the some other fields may appear.
   • Port Range – The first field is for the starting value for the port and the second for the ending value for the port range used by the protocol. Both of these values are inclusive.
   • Protocol field – This appears when the Other option is chosen. Enter the value of the protocol number for the protocol you wish to use.
9. Toggle the Log Allowed Traffic switch to the setting you want. If the slider is gray the option is disabled. If it is colored, it is enabled.
10. Toggle the Enable this policy switch to the setting you want. If the slider is gray the option is disabled. If it is colored, it is enabled. By default, this should be enabled
11. Click on the OK button to save the policy.

SSL mirroring for policies

You can configure the mirroring of SSL inspected traffic for IPv4 and IPv6 policies in the GUI. To use this option, configure the FortiGate to use SSL deep inspection instead of certificate inspection.

SSL inspection is automatically enabled when you enable a security profile in the policy configuration page. Selecting an SSL inspection profile that uses deep inspection reveals the Mirror SSL Traffic to Interfaces option. If you enable mirroring, an SSL Mirror Terms of Use agreement appears. Once you accept the agreement, you can select interfaces to mirror the traffic to in the Mirror SSL Traffic to Interfaces field.