Static Routes to DMZ hosts

Assuming that your DMZ comprises only one IP subnet and no VLANs/subinterfaces, then no, you don' t need to configure routes to individual DMZ hosts. And yes, configuring a route to the DMZ subnet is the common-practice standard approach.' Your config might could include something like this, where route 0 provides a default route to the internet, route 1 supports traffic to the internal network, and route 2 sends traffic to the DMZ:

  set system route number 0 dst 0.0.0.0 0.0.0.0 gw1 ExternalInterfaceIPaddress   set system route number 1 dst internalNetworkAddress internalNetmask gw1 internalInteraceIPaddress   set system route number 2 dst dmzNetworkAddress dmzNetmask gw1 dmzInterfaceIPaddress   

cheers, ybiC freelance consultant to Christian non-profits IOS, CatOS, Debian, Perl, Zaurus, Win32 desktop hw/sw, cable-plant testing

Below is the settings os the router table # get system route table No. Dst Gw1 interface Gw2 interface 0 0.0.0.0 0.0.0.0 (IProuter) auto auto As you can see, there is no routes defined to DMZ hosts (192.168.x.x) Should I add new routes to DMZ hosts?

Let me clarify a wee bit, good sir... You will need to add a routing table entry for your DMZ network, and you could do it in this format:

set system route number N dst DMZ_NETWORK_ADDRESS DMZ_NETMASK gw1 DMZ_INTERFACE_ADDRESS

The following assumptions[ul]

your DMZ network is addressed as 192.168.1.0

your DMZ network has a netmask of 255.255.255.255

your DMZ interface is addressed as 192.168.1.1

your Fortigate is set for NAT and not transparent mode

there are no other routes already in your routing table

you are using the CLI instead of the web GUI[/ul] result in this example:

set system route number 1 dst 192.168.1.0 255.255.255.0 gw1 192.168.1.1

You will likely also need to add a similar routing table entry for your inside network. That is, if you want the DMZ hosts to be able to communicate with inside network hosts.

Gah - I must have been on drugs when I posted my first two replies in this thread... 8^( No, you don' t need to configure any static routes for networks directly connected to your Fortigate interfaces (internal, wan, dmz, wlan etc). Static routing table entries are only needed for remote networks that aren' t behind your default gateway, and that only when you aren' t using dynamic routing in your network (rip, ospf, eigrp, etc). Any layer 3 routing device, like a Fortigate, automatically adds connected networks to it' s routing table. Apologies to any whom my initial advice may have mis-directed.