|
The source network 192.168.1.0/24 is directly connected to VLAN10.
The destination network 192.168.2.0/24 is directly connected to mgmt1.
By default, traffic between these networks follows the directly connected route.
However, if there is a requirement to route traffic from a specific source IP 192.168.1.10 (VLAN10) to a specific destination 192.168.2.30 (mgmt1) via port11 policy route
Source:
edit "VLAN10"
set vdom "root"
set ip 192.168.1.0 255.255.255.0
set allowaccess ping
set device-identification enable
set role lan
set snmp-index 68
set color 28
set interface "fortilink"
set vlanid 100
next
C 192.168.1.0/24 is directly connected, VLAN10
Destination:
edit "mgmt1"
set vdom "root"
set management-ip 192.168.2.2 255.255.255.0
set ip 192.168.2.1 255.255.255.0
set allowaccess ping https ssh http fgfm
set type physical
set role lan
set snmp-index 1
next
A specific static route has been added to reach the destination via port11
S 192.168.2.30/32 [10/0] via 192.168.2.254, port11, [1/0]
config router policy
edit 1
set input-device "VLAN10"
set srcaddr "192.168.1.0/24"
set dstaddr "192.168.2.0/24"
set gateway 192.168.2.254
set output-device "port11"
next
end
The firewall policy allows specific traffic from the source to the destination over port11
edit 122
set name "Test"
set uuid 1d3615bc-d983-51ef-e1ad-9282698740da
set srcintf "VLAN10"
set dstintf "port11"
set action accept
set srcaddr "192.168.1.10/32"
set dstaddr "192.168.2.30/32"
set schedule "always"
set service "ALL"
next
2025-01-23 13:13:16 id=65308 trace_id=10 func=print_pkt_detail line=5857 msg="vd-root:0 received a packet(proto=1, 192.168.1.10:1->192.168.2.30:2048) tun_id=0.0.0.0 from VLAN10. type=8, code=0, id=1, seq=13."
2025-01-23 13:13:16 id=65308 trace_id=10 func=init_ip_session_common line=6043 msg="allocate a new session-0d065999, tun_id=0.0.0.0"
2025-01-23 13:13:16 id=65308 trace_id=10 func=__vf_ip_route_input_rcu line=2001 msg="find a route: flag=80000000 gw-0.0.0.0 via root"
2025-01-23 13:13:16 id=65308 trace_id=10 func=__iprope_tree_check line=524 msg="gnum-100004, use int hash, slot=22, len=9"
2025-01-23 13:13:16 id=65308 trace_id=10 func=fw_local_in_handler line=615 msg="iprope_in_check() check failed on policy 0, drop"
The directly connected route always takes precedence over a static route. As a result, the policy route will not be applied, and this configuration will not work as intended.
|
