Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

New Contributor

Policy Routes for traffic from firewall

Hi all,

I have a FW device (in Azure, but I don't think that's important):

Public IP:
External IP (port1):
Internal IP (port2):

The public IP is natted to the external ip.  Both interfaces have HTTPS access enabled, so I can get into the web console on via public IP usually.

There's a site to site VPN, for which there's a static route for all remote site traffic (e.g. static route for goes to device VPN1).  If I'm on a client computer on the network (e.g and the VPN is up I can no longer get to HTTPS on the public IP (, I can on the internal interface address ( as you'd expect.

Pretty sure this is a routing issue.  Put a static route in for out of port1 and I can once again hit that HTTPS on the public IP, or drop the VPN and again it works.  So I figured I'd put a policy route in for anything on 443 with a source address of to go out of port1.  However this doesn't seem to all, I think it's still trying to shove it down the VPN.  A colleague mentioned that he would expect to have to set somewhere to say to apply that policy route to traffic originating from "self" or similar, but all the Fortinet gives me is a list of ports or VPNs.

Am I missing something here?



New Contributor

What exactly do seek to achieve with the information provided above.

Let us know the objective of the setup you want to achieve.

such information will help us provide adequate feedback to support your configuration.