External captive portal redirect (Entra ID) from a routed subnet

Hello guys,

I have a cluster configured to ask users authentication using Entra ID account. This is working when using host connected to an interface that is directly managed by Fortinet (and it creates the local in policy for port 1003), but I need to make it works also from a routed subnet that is passing thru a transit interface (it’s an MPLS line), but the redirect doesn’t work for this interface.

I've created the zone and relative rules, but nothing to do.

any suggestion?

thanks in advance!