Cannot access internal lan2 from internal lan1

[Steve_Wertheimer]

I have the 60c all setup and everything almost works as I want it to. 1st issue - I created a rule to be able to access LAN2 from LAN 1, both being on different subnets with the LAN ports operating in -- mode. I use LAN 1 for all traffic except my VoIP LAN, LAN2. The rule is simple and didn' t require a route policy. It worked fine until I upgraded form 4.0 MR2 to MR3 patch 4 The rule is as follows: Source Interface /Zone: Internal 1 Source Address: 192.168.103 range (Created an address 192.168.103.0/24) Destination Interface /Zone: Internal 2 Destination address:192.168.106 Range (Created an address 192.168.106.0/24) Schedule: always Service: Any Enable Nat: no It worked before the upgrade - now I can only access the Interface address of 192.168.106.1. Logs show " started" under status when I try to access anything else other than the port itself. All I want to do is be able to use HTTP to access the VoIP Lan/phones etc... Makes no difference where I put the rule, it still doesn' t work. I tried adding a Policy Route, but that didn' t change anything. I know this should be an easy fix...but I' m stumped. I also have a few VPN tunnels at the top of the list, and they work perfectly On another note - I' m on a MAC in a Windows Domain...and since moving away from my Sonicwall' s...the network browsing is ungodly slow on the MAC' s. Spoke to T/S and they tried and tried but were not able to resolve that issue.

[FortiRack_Eric]

If you have to use policy route then your routing was wrong in the first place. You better take a good look on your active routing table. The diag debug flow would have shown that the routing choice would not have matched internal2 as a destination interface. You will run into other problems that have to be fixed with another policy based routing and so on. This is a wrong fix.

[Steve_Wertheimer]

When I spoke to the Fortinet tech' s, they told me the rule would not work without this policy and that this was the correct way to do it. Now, I' m confused...

[ede_pfau]

I agree with Eric. You don' t have to set explicit routes or even policy routes to achieve this, as both networks are directly connected (see routing monitor in one of your earlier posts). Is there anything related that you haven' t mentioned?

[Steve_Wertheimer]

Nothing at all that I can see...