Skip to main content
Contributor
May 31, 2007
Question

FG originated traffic goes on wrong interface, while policy routing

  • May 31, 2007
  • 3 replies
  • 2832 views
Hello I have a FG50B with 3.0 MR4, policy routing is configured and is working correctly. The problem I have is with traffic that is originated from the FG itself (pings, updates, DNS lookups). This article (http://kc.forticare.com/default.asp?id=815&Lang=1&SID=) seems to say that the static route with the lowest " ID" (edit value) is chosen to originate the FG' s own traffic. But this does not work for me. Here are my static routes :
edit 1      set device " wan2"       set gateway x.x.141.105  next  edit 2      set device " wan1"       set gateway y.y.13.129  next
The output of a " get router info routing-table det" :
S*      0.0.0.0/0 [10/0] via x.x.141.105, wan2                    [10/0] via y.y.13.129, wan1
All this would seem to indicate that the FG' s own traffic should go out of wan2, yet a " exec traceroute 209.85.135.104" gives :
traceroute to 209.85.135.104 (209.85.135.104), 32 hops max, 72 byte packets   1  y.y.13.129  1 ms  1 ms  0 ms   2  y.y.168.109  5 ms  4 ms  3 ms   3  213.162.24.209  5 ms  4 ms  4 ms   4 etc...  
For info (even though the documentation says FG' s own traffic is not affected by policy routing), here is my policy routing rules:
edit 1      set end-port 22      set input-device " internal"       set output-device " wan1"       set protocol 6      set start-port 22  next  edit 2      set end-port 3389      set input-device " internal"       set output-device " wan1"       set protocol 6      set start-port 3389  next  edit 10      set input-device " internal"       set output-device " wan2"   next
Note : the last rule is number 10, so that I can add other rules before it without needing to move everything around. Any idea why this is happening ? (Sorry for the overly long post, I have a problem condensing my point of view :) ) Murphy

    3 replies

    Fireshield
    New Member
    May 31, 2007
    The problem is that you have 2 equal routes but have neither as a priority. Try this: edit 1 set device " wan2" set gateway x.x.141.105 set priority 1 next edit 2 set device " wan1" set gateway y.y.13.129 set priority 2 next
    Contributor
    May 31, 2007
    Hemm, my understanding of the new Priority setting (new in 3.0, I think), was that it would push *all* my traffic through one interface, breaking the policy routing. But I will try it, thanks for the answer. Murphy
    Fireshield
    New Member
    May 31, 2007
    Policy routes will always take priority over static routes. This does not change with priority set.