Fortigate 60F - Devices on same interface hitting different policies help!

Forum|Forum|3 months ago
February 20, 2026
2 replies
818 views

Hi all,

I’m running into a weird issue with our FortiGate 60F and could use some guidance. Here’s the context:

We’re planning to shut down our on-prem DNS server and move some devices to use public DNS at one of our sites. The problem is that, even though all affected devices are on the same subnet/interface and show similar IP config, some are hitting the implicit deny policy while others are hitting my LAN-to-WAN policy.

Here’s what I’ve observed. Devices that can’t reach public DNS can still browse the web using our on-prem DNS server. This server has conditional forwarders pointing to 8.8.8.8and 8.8.4.4. I have a firewall policy list as follows:

LAN-to-Netsweeper – forwards all HTTP/HTTPS traffic to our web filtering provider.
LAN-to-WAN – should catch everything else, including traffic from our internal interface 172.24.XX.XX/22.

The problem is that, for devices on the same subnet:

Some hit the LAN-to-WAN policy as expected.
Some hit the implicit deny instead.

I’ve also attached a screenshot of the interface settings.

I’m trying to understand why the firewall is treating these devices differently even though they’re on the same subnet/interface. Could this be related to DNS traffic, session handling, or policy order? Any advice or things I should check would be greatly appreciated.

Please let me know if any further information is required.

Fortigate Internal.png

Fortigate Policy List.png

funkylicious

SuperUser

hi,

for this "LAN-to-Netsweeper – forwards all HTTP/HTTPS traffic to our web filtering provider." do you have a policy route that instructs hosts in LAN - 172.24.X.X/24 to forward all HTTP/HTTPS to the tunnel ?

if you have just a default route towards the tunnel it will be dropped as expected, make sure that you create a route policy and specify that HTTP/HTTPS traffic should only be routed towards it.

"jack of all trades, master of none"

iainhsAuthor

Explorer

Hi Funky,

Thanks for the quick response! I've posted the policy routes below so yes all HTTP/HTTPS traffic is being forwarded to the tunnel as expected however some of the clients on the 'internal' interface are not able to use public DNS they are having to use our on prem DNS server (which I want to shut down). Should all the clients on the internal interface be able to reach public DNS as they should all be included in the LAN to WAN policy however some are going into the impicit deny but I thought that the Firewall should see them the same as they are in the same subnet.

policy routes 2.png