Technical Tip: Local-out IKE traffic match Policy Based Routing

[aionescu]

Description	This article describes how to configure the FortiGate so local-out IKE traffic matches the configured Policy Based Routing.
Scope	FortiGate v 6.4.9, v7.0.2 and v7.2.0.
Solution	There are cases when IKE local-out traffic needs to match a configured Policy-Based Routing. Since v6.4.9, 7.0.2 and v7.2.0, a new, per VDOM, option was introduced: config system setting set ike-policy-route enable | disable By default, the ike-policy-route is disabled. When disabled, the policy route is not being checked and the FortiGate only checks the routing table. When enabled, the FortiGate first checks the Policy route to send the IKE packets before checking the routing table. Note that for a PBR match, the firewall must have a valid route to the remote gateway. More information about enabling policy route lookup for local-out IKE traffic: Technical Tip: Enable policy route lookup for local-out IKE traffic More information about Policy-Based Routing: Policy routing