How how can I limit the traffic to only one SD-WAN interface

[fortinetforumfiokom]

Hi, 

(Fortigate 201F, 7.4.3)

I have a new SD-WAN setting, and I have an internal e-mail server. How can I limit the email server traffic (SMTP) so that traffic  only goes out through the designated SD-WAN interface. If that interfece go down, I do not want to allow to go this traffic out in other SD-WAN interface. 

A would like to prevent the email traffic to go out from an other public IP.  My current goal is not to configure the mail server (DNS, MX, SPF etc...)

I tried to create an SD-WAN rule (Interface selection strategy = Manual) with the mail server address and SMTP traffic, where I only specify one SD-WAN interface in the interface preferences, but it seems that if I stop this interface, the traffic still starts to go out on the other interface. How can I stop this from happening?

Thanks

[sjoshi]

You can create 2 sdwan zone and place each interface in separate zone and create 2 firewall policy with 2 zone and on the 2nd zone set the action as deny

[vbandha]

Hi @fortinetforumfiokom ,

One solution would be to create a policy route for this traffic. 

Policy route has higher priority than SD WAN rule so the traffic would follow the Policy route you create. 

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/144044/policy-routes

Regards,

Varun

[jodigriego219]

Go out through a specific SD-WAN interface on your Fortigate 201F and doesn't failover to another interface when it goes down, you can configure a dedicated SD-WAN rule with a failover condition set to "Disable" or use a policy route. In the SD-WAN rule, specify your email server’s IP address for SMTP traffic and set the desired interface as the only option. Additionally, in the SD-WAN configuration, make sure that the "Interface health check" for the chosen interface is active, and configure the failover action to prevent any traffic rerouting. You can also create a policy route with a higher priority to direct the SMTP traffic exclusively through that interface, ensuring no fallback to another interface in case of failure.