PBR

[akshaywaghm]

Hello everyone,

I’m currently facing an issue with the FG3501F Firewall. If anyone has encountered something similar, could you share the technical reason behind it?

Here’s the scenario:

We have two interfaces on the Fortigate firewall connected to the Server Farm—Port1 and Port8. The goal is to route internet traffic via a static route and intranet traffic via Policy-Based Routing (PBR). We’ve configured PBR for the /16 subnets toward Port1 for intranet traffic, while adding a static route for the same subnets towards Port8 for internet traffic. However, the firewall is not prioritizing the PBR, and *all traffic is routing through the static route instead*.

Any insights?

[dingjerry_FTNT]

Hi @akshaywaghm ,

I believe that you are asking why the traffic to the Server Farm is always through port1, not port8, right?

If yes, that's because, for PBR, FGT is matching the traffic with the source interface, destination address, and service, once matched, direct it to the destination interface.

The PBR policies with port1 and por8 must be very similar, except the destination interface, one is por1, another one is port8.

The one with port1 must be above the other one with port8.  So it is always being matched first.  And once matched, it will skip all the rest of the PBR policies.

[akshaywaghm]

No, my concern is Y the firewall is not prioritizing the PBR, and *all traffic is routing through the static route instead*

[dingjerry_FTNT]

Hi @akshaywaghm ,

Then you need to share the PBR configurations and share details about what the traffic is, including something like source address, destination address, source interface. destination interface, service (protocol and/or port), and so on.

And please share the routing table on FGT:

get router info routing-table all

[Toshi_Esumi]

First, you need to understand how FGT's PBR works. For any PBR to work based on the source, in your case the /16, the FGT needs to have routes for the destination to the port the PBR would steer to. In your case, both port1 and por8 need to have a default route each because your destination you want to steer the traffic is just general internet.
Then the PBR you configure comes into play to choose port1, instead of port8, only for the /16 source.
And then you need another PBR to steer the rest of sources toward port8 for their internet.

Be aware that no failover would work once you start using PBR to "bind" specific traffic to a specific outgoing port even when the port goes down.

Toshi

[LandryFinn]

I also faced the same issue.

[dingjerry_FTNT]

Hi @LandryFinn ,

Please share the PBR configurations and the details about the interesting traffic.

And please share the routing table on FGT:

get router info routing-table all