Skip to main content
pawanrohilla1984
pawanrohilla1984
New Member
October 11, 2018
Question

Policy route for some IP Address

  • October 11, 2018
  • 5 replies
  • 14845 views

hi,

 

i have Fortigate 60E firewall with 5.4.10 Version. WAN1 Leases line connection with static ip address. WAN2 local ip through DSL router.

i want some ip address's (192.168.1.11-15, 5 ip address) traffic should go through from WAN2 and rest traffic should go from default WAN1.

Static route configuration

WAN1  Distance 10 Priority 10

WAN2  Distance 10 Priority 20

 

while creating policy route, it is not showing "Source Address" option.

 

how can enable source address in policy route or any alternate way to configure the same?

 

Thanks

 

    5 replies

    Fullmoon
    Fullmoon
    New Member
    October 11, 2018

    this can be done through Policy Route

    pawanrohilla1984
    pawanrohilla1984Author
    New Member
    October 12, 2018

    i think this is not possible through policy route. 

    When i add a policy route with source as 192.168.1.11/24, 192.168.1.12/24...... 192.168.1.15/24, it is creating policy route for entire subnet 192.168.1.0.

    so all traffic start going from WAN2.

    we can route traffic for any port or protocol but we can't route traffic for IP Address range.

     

    i think this is loose point in Fortinet.

     

    If anyone have done this, can i have step by step configuration for creating policy route?

    tanr
    tanr
    New Member
    October 12, 2018
    By specifying 192.168.1.X/24 your specifying the whole 192.168.1.0/24 subnet regardless of X.
    pawanrohilla1984
    pawanrohilla1984Author
    New Member
    October 12, 2018

    so, what to specify in "source field" to enable this policy for particular IP address range?

    i want to create policy for 192.168.1.11 to 15 (5 IP Address) not for whole subnet.

     

    any idea...!

     

     

     

    tanr
    tanr
    New Member
    October 12, 2018
    You can use a subnet calculator like [link]https://www.ipaddressguide.com/cidr[/link] to calculate them. The range you specified would actually be two cidr ranges, so won’t work directly. You can create address objects on the FortiGate that’s are ranges (instead of subnets with masks) though and may be able to use the address objects.
    Sudarsan_Babu
    Sudarsan_Babu
    New Member
    October 12, 2018

    Hi can you try in cli.    In cli    config router policy  edit 1  set input-device "internal"  set src "x.x.x.x "                ------------->   Internal Subnet set dst "0.0.0.0/0.0.0.0"  set gateway  Y.Y.Y.Y           ------------->   WAN  set output-device "wan2"  end 

    tanr
    tanr
    New Member
    October 12, 2018
    You’ll have to just use a subnet then - perhaps changing some of those IPs to fit.
    sw2090
    SuperUser
    sw2090
    SuperUser
    October 15, 2018

    The most easiest way might be this:

     

    - create an ip range object for 192.168.1.11-15

    - create a policy: source interface is where your 192.168.1.0/24 resides. Destination WAN2. Source is the range object you created above, destination any, service any.

    - make sure this policy comes BEFORE the other internet policies to have it be the first that matches. 

     

    Then traffic from out 192.168.1.11-15 to the internet will match this policy and go to WAN2 and all other traffic from 192.168.1.0/24 will match some other policy and go to WAN1.

    Terms & ConditionsAccessibility statement