Troubleshooting Tip: Resolving Policy Not Working with Source NAT IP Addresses

To resolve the policy not working with Source NAT IP addresses, follow these steps:

1. Make sure the route to the destination is learned from the correct interface. In this case, the route was learned from BGP via WAN2, while a static route with /16 was created for the destination subnet via the tunnel interface.
2. Since the route learned from BGP was /32 via WAN2, FortiGate is sending the traffic out via WAN2 instead of the tunnel interface.
3. Verify that the more specific route (longer subnet mask) takes precedence. A /32 covers exactly one IP address, so it is more specific than/16.
4. Add a static route for the destination server with /32. This will ensure that the traffic is routed correctly.
5. After adding the static route, verify that the user can telnet to the server.
6. The remote side needs to know which source IPs are allowed over the tunnel, which means that the SNAT IP must be a part of Phase2 selectors.

By following these steps, the policy should now be working correctly with the Source NAT IP addresses.

Related article:

Technical Tip: Implement Source-NAT for IPsec interface