Technical Tip: Policy based routing case scenario

Description

This article describes an example of policy based routing.

Scope 

FortiGate.

Solution

Policy Based routing example:

A FortiGate-VM with two WAN interfaces that uses policies to direct traffic to a specific interface.

The rules the policies need to implement are:

• The HTTP and HTTPS traffic should always go out from WAN2 interface.
• The sample below shows policy 1 and policy 2. The VPN traffic should go out via WAN2 (Policy 3).
• Note that the source and destination subnets for that particular VPN are specified here for understanding.
• All other traffic should go out WAN1 (Policy 4).

Note:  If the WAN interface is using PPPOE or DHCP, it is better not to specify the gateway in the policy.

In this case, the gateway is taken from the interface setting. The gateway should be set to 0.0.0.0.

This will ensure that if Ping Server is used, when the failover happens, the policy route will choose the active interface.

# config router policy
    edit 1
        set end-port 80
        set input-device "internal"
        set output-device "wan2"
        set protocol 6
        set start-port 80
    next
    edit 2
        set end-port 443
        set input-device "internal"
        set output-device "wan2"
        set protocol 6
        set start-port 443
    next
    edit 3
        set dst 10.0.47.0 255.255.255.0
        set input-device "internal"
        set output-device "wan2"
        set src 10.0.46.0 255.255.255.0
    next
    edit 4
        set input-device "internal"
        set output-device "wan1"
    next

Following shows how to configure the same in GUI.

Navigate to Network -> Policy Routes -> Select Create New.

Note: There is no need to create an address object to call the subnet in the policy route. The IP address is enough.