| Description | This article describes how to use source IP for the local out traffic in a static route. |
| Scope | FortiGate v7.4.0 and above. |
| Solution |
Preferred Source is a new feature for local-out routing introduced in FortiOS v7.4.0. See the new feature announcement 'New Feature: Allow better control over the source IP used by each egress interface for local out tra...'.
In v7.4 and later, it is possible to add the preferred-source IP in the static route, SD-WAN rule, or router route-map.
SD-WAN:
Note: To configure a custom source IP address for SD-WAN health check probes, use 'set source X.X.X.X' in the SD-WAN member instead of preferred-source. See the article 'How to configure source IP for Secure SD-WAN Performance SLA'.
Where configured, 'source-ip' takes precedence over 'preferred-source': Once configured, the new preferred-source address takes effect for any local-out management traffic using that route, unless source-ip is specified elsewhere
For example, when source-ip is specified in 'config system dns', FortiGate will continue to use the specified IP address as the source address for DNS lookups.
config router static edit 1 set gateway 10.5.31.254 set preferred-source 10.133.200.1 set device "port1" next end
config system dns set primary 96.45.46.46 set source-ip 10.133.200.4 end
interfaces=[any] filters=[port 53 and host (10.133.200.1 or 10.133.200.4)] 2024-11-04 17:16:02.942575 port1 out 10.133.200.4.1898 -> 96.45.46.46.53: udp 46 2024-11-04 17:16:05.112552 port1 out 10.133.200.4.1898 -> 96.45.46.46.53: udp 42
Other local-out traffic from port1 will use the preferred-source address configured in the matching static route unless source-ip is otherwise specified.
For example, manual ping of remote address 1.2.3.4 from FortiGate CLI will use source address 10.133.200.1 by default.
FGT61F-A # diagnose sniffer packet any 'proto 1 and host 1.2.3.4' 4 2 l
Preferred-source affects many different kinds of local-out traffic, including the following:
It is strongly recommended to verify FortiGate still has intended routing after configuring preferred-source.
IPsec tunnel negotiation and ESP traffic do not use preferred-source. They use the configured local-gw if any, or the primary IP address of the parent interface if local-gw is not specified.
config vpn ipsec phase1-interface edit "example tunnel" set interface "port1" next end
FGT61F-A # diagnose sniffer packet any 'port 500 and host 1.2.3.4' 4 2 l
In v7.2 or below, there is no option to provide the Preferred Source IP in the static route and the SD-WAN:
SD-WAN: |
