Policy Routes vs Firewall Policies

[MTrin]

Hi there. I' m a bit new to Fortigate and have tried to search for this answer. I have a set of policy routes that go to a specific gateway not the default on routing table. Problem is, application filtering doesn' t work and firewall rules seem to be erratic. When I debug flow, all I see is the " find a route" fo the policy route but no fw policy being matched. So question is, does static route bypass all firewall rules? I don' t get it because it' s too erratic and debug doesn' t give me the information I want. Thanks for any help

[Dipen]

No ! Static route will not bypass the Firewall Policy. Same is true for Policy route as well. Both Static Route and Policy Route require a Firewall Policy to work. Ideally only static route is required; a policy route is only required if we want a subset to override the static route.

[MTrin]

That' s what I thought. So what would explain traffic not matching any policy on debug? flow trace addr 192.168.121.123 all it says: find next route (the policy route) and application filter won' t work.. well I guess I will keep digging

[emnoc]

So is the problem application filtering or the fwpolicy itself? Do you have a application filter applied to the firewall policy that' s in question? & ave you double check the fwpolicyID based on the debug flow output to ensure nothing e.g your ordering of the fwpolicies This might give you ideal as to you re-adjust the fwpolicies to match the policy-route interfaces & order and diag debug again and see if any thing improves.