Technical Tip: Policy routes will not work for FortiGate initiated traffic

This article describes that policy routes will not work for FortiGate-initiated traffic.

Policy routes are designed for forwarding traffic not for local out traffic.

Let's say that a specific subnet has been configured to forward through specific gateway using policy route, and to test the policy route by initiating the traffic from the firewall, it will not work.

Results will be unexpected.

Even if a source is mentioned as the LAN interface IP of the firewall while pinging using this command:

execute ping-options source 192.168.0.1 <----- If 192.168.0.1 is the lan interface IP.

It will not match the policy route, because still it is local out traffic only.

To test policy routes working, use the internal machine and initiate traffic.

Because these policy routes are designed for forwarding traffic.

Related articles:

Technical Tip: Pinging out to Internet from local interface

Technical Tip: Unable to ping public servers (for testing) using ping-option source interface