Technical Tip: Controlling Outgoing Traffic via Static and BGP Route Using Policy Route

[abalachandran]

Description	This article describes how to control Outgoing Traffic via Static and BGP Route Using Policy Route.
Scope	FortiGate.
Solution	Whenever there is a route learned via BGP and Static at the same time, the FortiGate will only install the static route by default Even when the ad values are made the same (by modifying the ad on the static route), it will be observed that only the static route will be installed on the FortiGate routing table. Example: Using a policy route will allow users to still be able to push traffic for the same destination learned via BGP despite only the static route being installed in the FortiGate routing table. Scenario: (port 1) <-> ISP 1 (via static default route). LAN <-> (Port 2) FGT. (port 3) <-> ISP 2 (default route learned via BGP). Policy Route: In the example above, it can be observed that a policy route has been configured to control outgoing traffic from port2 on the FortiGate towards 8.8.8.8 via port1 (ISP 1) and all traffic towards 1.1.1.1 via port 3 (ISP 2). Upon configuring the necessary firewall policy to facilitate the requirement above on the FortiGate, it can be observed that the outgoing traffic can be controlled as per the policy route configuration above.