Policy Based Routing in FortiGate Firewall

[begad_nashaat]

Dears,

I want to connect three internet connections (connected to three different ISPs) to my Fortigate firewall, accordingly I want to configure the fortigate to route traffic based on the source subnet.

Let's say that my network is divided into three different VLANs with different subnets addresses as shown below:

[ul]

VLAN 10 -> 10.0.10.0/24

VLAN 20 -> 10.0.20.0/24

VLAN 30 -> 10.0.30.0/24[/ul]

Also, the internet connection are connected to below Outside interfaces on the fortigate:

[ul]

ISP1 -> Outside1

ISP2 -> Outside2

ISP3 -> Outside3[/ul]

My target is to configure the fortigate to route Internet traffic based on the source subnet as mentioned below:

[ul]

Internet traffic sourced from VLAN10 (10.0.10.0/24) to be routed through ISP1 (Outside1)

Internet traffic sourced from VLAN20 (10.0.20.0/24) to be routed through ISP2 (Outside2)

Internet traffic sourced from VLAN30 (10.0.30.0/24) to be routed through ISP3 (Outside3)[/ul]

Any ideas ??????

Appreciate your feedback.

Best Regards,

Begad Ahmed

[Zeihold_von_SSL]

Funny, I was just working on the exact same issue a few hours ago. So far I came up with no idea. Maybe it is possible to use three vdoms to seperate the isps (routing tables) and vlans. But it sucks if you want to allow inter vlan traffic (because you have to configure inter-vdom links). But hopefully someone else has a good idea to realize that. I would slso love to hear any suggestions.

[vjoshi_FTNT]

Hello,

This can be achieved with 3 default routes and 3 policy based routes

- Connect all the 3 ISPs to 3 Interfaces of the Fortigate and configure it accordingly

- Have equal distance for all the default routes

- Create 3 policy based routes from the respective VLAN1 > Outside1 with respective source address and do the same for other VLANs

- One challenge would be, what if VLANs should be allowed communicate with each other (VLAN1 > VLAN2)

- You need another Policy based route for specific destinations on top of all

Hope that helps

[Zeihold_von_SSL]

Yeah poliy based routing works fine, but it also sucks if the vlans should communicate which each other (or in my case one vlan/zone) should talk to several other networks via vpn. But your are right, policy based routing should do the trick in some scenarios.

[FortiRack_Eric]

Another scenario is to create 3 vdoms with each a VLAN and corresponding ISP. 

This eliminates the need of policy based routing. Which, as a rule of thumb should be a last resort and not a standard solution to use.

[emnoc]

agreed

And use inter-vdom links with the correct fwpolicies between vlans traffic.

[begad_nashaat]

Thanks for your reply !!

Can you please share with me sample of configuration required to fulfill my requirements ?

Best Regards,

Begad Ahmed