New Member

Question

Output traffic with default route BGP

16 replies
6145 views

Good morning everyone
I recently entered the fortinet world. I have a Fortinet-VM02 that gets the default route via BGP (configured on port3) from our main router. On another interface (port4) the static public IP announced via BGP is configured. Port4 is the WAN port that will provide connectivity to our servers. I have to let the traffic generated by the firewall itself (output) exit from the IP of interface 4 instead of 3 otherwise the firewall does not renew the license or other services that require internet.

the firewall obviously exits from 3 indicating the IP of interface 3 as the source address

The forward traffic is ok, the VMs connected under port 4 navigate with their static IP belonging to the /24 subnet announced via bgp, the problem is only the output traffic of the firewall itself.

thanks to whoever will answer me

FortiGate

HarshChavda

Staff

Hello @danny1989 ,

You can configure a policy-based route which can directs the firewall’s traffic to use a specific interface based on the source address or other criteria. You can create address object and create policy accordingly.

Toshi_Esumi

SuperUser

The FortiGuard IPs your FGT-VM needs to reach are multiple and may change. So at least you need to have static routes to the FQDNs for those IPs toward the port4 if there is no default route to that direction.
https://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/301421/update-server-location

Toshi

vbandha

Staff

Hi @danny1989 ,

For fortiguard traffic originating from fortigate you can specify fortigate interface and source IP for the traffic to take:

https://docs.fortinet.com/document/fortigate/7.0.5/cli-reference/110620/config-system-fortiguard

config system fortiguard

set fortiguard-anycast disable

set interface-select-method specify

set interface <outgoing interface>

set source-ip <IP of the interface>

end

Try that and see if it works for you.

Regards,

Varun

dingjerry_FTNT

Staff

Hi @danny1989 ,

I think that you have two default routes with the same distance and maybe the one via port3 has a higher priority.

You can check and verify this info using this command:

get router info routing-table all

If this is the case and if the default route via port4 is a static route, the easier way for you:

1) Modify the default route via port4 to have a higher priority;

2) Create a policy route for passthrough traffic via port3;

dingjerry_FTNT

Staff

Please refer to this KB for Policy Route configuration:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-the-Firewall-Policy-Routes/ta-p/189996

vbandha

Staff

Hello @danny1989

You mentioned this earlier:
'Exactly, the traffic must not go out from port4, I just have to use the IP of port4 but it could also be the IP of the Loopback'

This maybe tricky. If we do send the packet out port3 with Source IP as Port4 IP, how will the reply be received?

I don't think this type of setup would be possible.

Also, you can't use private IP of loopback as source on the internet, it has to be a public IP.

If you have IP pool of Public IPs on port3 let's say then we could use one of them as source and not use the port3 interface IP itself.

Regards,

Varun

Toshi_Esumi

SuperUser

That's why I assumed the subnet was advertised by BGP to the neighbor through port3. And if it's not a public subnet, there have to be NAT in upstream device (or the nighbor).

Toshi