Situation

# 攝影機軟體IPscan使用廣播發送，攝影機回應用Multicast 224.0.0.1找PC
IPscan camera software sends broadcast packets and the camera responds using Multicast (224.0.0.1) to find the PC.

# PC要跨網段大量搜尋攝影機卻因為廣播被阻擋
The PC needs to search for cameras across subnets, but the search is blocked due to broadcast packet restrictions.

Solution

[1]
Login FortiGate WebUI > CLI


[2]
＃ 224.0.0.1是所有主機，TTL = 1所以要讓他不扣成0
config system settings
    set multicast-ttl-notchange enable
end


[3]
# 開啟multicast-policy功能
System > Feature Visibility > Additional Features > Multicast Policy > enable


[4]
# allbroadcast = 255.255.255.255, 開啟政策可以讓VLAN之間傳遞廣播，但要小心使用 > 廣播網域過大會太吵雜影響效能
config firewall multicast-policy
    edit 1
        set log traffic enable
        set srcintf "VLAN1"
        set dstintf "VLAN2"
        set srcaddr "all"
        set dstaddr "allbroadcast"
    next
end

[5]
# dstaddr all = 224.0.0.0 ~ 239.255.255.255
config firewall multicast-policy
    edit 2
        set log traffic enable
        set srcintf "VLAN2"
        set dstintf "VLAN1"
        set srcaddr "all"
        set dstaddr "all"
    next
end

Check

# CLI 看一下流量有沒有經過
diagnose sniffer packet any "broadcast" 4 0 3
diagnose sniffer packet any "multicast" 4 0 3
diagnose sniffer packet port1 "host 224.0.0.1 or broadcast" 4 0 3