FG originated traffic goes on wrong interface, while policy routing

[#1]

Hello I have a FG50B with 3.0 MR4, policy routing is configured and is working correctly. The problem I have is with traffic that is originated from the FG itself (pings, updates, DNS lookups). This article (http://kc.forticare.com/default.asp?id=815&Lang=1&SID=) seems to say that the static route with the lowest " ID" (edit value) is chosen to originate the FG' s own traffic. But this does not work for me. Here are my static routes :

edit 1
     set device " wan2" 
     set gateway x.x.141.105
 next
 edit 2
     set device " wan1" 
     set gateway y.y.13.129
 next

The output of a " get router info routing-table det" :

S*      0.0.0.0/0 [10/0] via x.x.141.105, wan2
                   [10/0] via y.y.13.129, wan1

All this would seem to indicate that the FG' s own traffic should go out of wan2, yet a " exec traceroute 209.85.135.104" gives :

traceroute to 209.85.135.104 (209.85.135.104), 32 hops max, 72 byte packets
  1  y.y.13.129  1 ms  1 ms  0 ms
  2  y.y.168.109  5 ms  4 ms  3 ms
  3  213.162.24.209  5 ms  4 ms  4 ms
  4 etc...
 

For info (even though the documentation says FG' s own traffic is not affected by policy routing), here is my policy routing rules:

edit 1
     set end-port 22
     set input-device " internal" 
     set output-device " wan1" 
     set protocol 6
     set start-port 22
 next
 edit 2
     set end-port 3389
     set input-device " internal" 
     set output-device " wan1" 
     set protocol 6
     set start-port 3389
 next
 edit 10
     set input-device " internal" 
     set output-device " wan2" 
 next

Note : the last rule is number 10, so that I can add other rules before it without needing to move everything around. Any idea why this is happening ? (Sorry for the overly long post, I have a problem condensing my point of view :) ) Murphy

[Fireshield]

The problem is that you have 2 equal routes but have neither as a priority. Try this: edit 1 set device " wan2" set gateway x.x.141.105 set priority 1 next edit 2 set device " wan1" set gateway y.y.13.129 set priority 2 next

[#3]

Hemm, my understanding of the new Priority setting (new in 3.0, I think), was that it would push *all* my traffic through one interface, breaking the policy routing. But I will try it, thanks for the answer. Murphy

[Fireshield]

Policy routes will always take priority over static routes. This does not change with priority set.