routing between internal networks via external interface?

Welcome to the forums. Does it not work now? What have you tried?

No, it doesn' t. traceroute from net1 to my desired VIP times-out somewhere on the ISP1 network. I tried to add policy routes (before default policy route from net1): from net1 to desired VIP via ISP2 interface ip or gateway, from external ip on ISP1 to desired VIP via ISP2 interface ip or gateway. And both ways the traceroute times-out somewhere on the fortigate. What policy route should i add?

Do i understand you correct, you suggest to remove policy routes and to add firewall policy? I did that (except removing default net1 policy route)- tried to add any combinations of src/dst interfaces/ip' s/subnets and it had no effect- traceroute dissapears on ISP1 network, and firewall policy counters are zero after trying to access VIP.

So anyone has idea what policy routes and firewall policies i should add?

Hi andrwsL!

I wish to provide access from guest network1 to service in network2 via VIP on ISP2 interface. Why do i want it such way? Guest network1 is using isp' s dns servers, and i dont want to allow accessing network2 internal dns servers, or to lose fortigate' s protection capabilities.

To me, your design seems not the simplest possible with your objectives stated above. Remember that by default Fortigate discards packets on interfaces where their src IPs are not supposed to appear. Even though you use VIPs on the outside, I suppose it won' t work without changing this RPF from strict (default) to loose and this possiblility seems reserved for different purposes anyways. But then again, I don' t like the idea of externalizing the inner traffic. The routing between interfaces is already there so why don' t you just allow desirable communication from NET1 to NET2 with regular FW polices and rely on implicit deny for the rest, including internal DNS? IMHO, this case should involve internal interfaces only, unless I' m missing something from your description, then pls let me know. Cheers! Rafal

I also think you' re going for a complicated solution when a simple one is available. If I understand your original post correctly, your only reason for not simply setting up firewall rules to allow direct traffic is DNS. I would simply setup a local DNS server on the fortigate that has the handful of entries you would need to customize. The guest network can be configured to use this DNS " server" as their first choice, then recursivley use the ISP DNS server for anything that isn' t matched locally.