Operation to enable asymroute because policy-based routing can't be worked.

[KenjiKang]

Hi,

I need to configure policy-based routing and I'm testing it, but it doesn't work even though the configuration is correct.

According to a veteran's advice, I temporarily enabled asymroute, and when I immediately disabled it, the routing started working.

I'm reluctant to use this method. Is this a well-known workaround?
Do you have any advice on a better way to handle this?

Hardware: FortiGate 120G OS: 7.4.8

Thanks,
Kenji

[AEK · Accepted solution]

As per my knowledge in FGT by default the traffic "must" return from the exac path from which it came. E.g.: if the request entered from port1 and exit from port2, then the return traffic must enter from port2 and exit from port1. This info is written in the session. 

This behavior can't be changed with policy routing unless you enable asymmetric routing (not recommended) or auxiliary sessions.

[AEK · Accepted solution]

As per my knowledge in FGT by default the traffic "must" return from the exac path from which it came. E.g.: if the request entered from port1 and exit from port2, then the return traffic must enter from port2 and exit from port1. This info is written in the session. 

This behavior can't be changed with policy routing unless you enable asymmetric routing (not recommended) or auxiliary sessions.

[Toshi_Esumi · Accepted solution]

I'm still not exactly sure what your goal with this set up is.
As @AEK explained, a FGT is a FW, which tracks "sessions" containing initiating direction and returning direction for all traffic. Once the session is initiated by the first packet, the FGT finds the session when packets for returning direction come back. At that time, they go back out to the original incoming interface as long as a proper/matching route still exist. This is also the basic mechanism for anti-spoofing.
Policies and policy routes affect only for the session initiation traffic. The fate of all subsequent traffic and all returning traffic for the same session is decided at the time of the session initiation.

Toshi

[KenjiKang]

Toshi-san

Thank you for the kind advice.

Regarding the production configuration, it will be slightly different from the diagram I showed you earlier.
My intended configuration was to use policy-based routing for return traffic.

However, since I've now confirmed that the FortiGate (FGT) will send return traffic back to the receiving port due to its specifications, this information is very helpful because I now know what I need to do to resolve the issue.

You also gave me the idea of adding a lower-priority routing as needed, so I believe this approach will solve the problem.

Thank you
Kenji

[KenjiKang]

Hi AEK-san

Thank you for the kind advice.

I'm glad to have confirmed that I cannot enable asymmetric routing or auxiliary sessions, and that I cannot configure the return traffic with policy-based routing.
That's exactly what I wanted to confirm.

[Riolab23]

Hi Kenji,

Enabling asymroute is a known workaround but not ideal. I'd recommend double-checking your policy-based routing setup and ensuring there are no conflicts with the routing table or session-based routing. Try clearing the policy and reapplying the rules to see if that fixes the issue.