Policy doubt

[luca1994]

Hello team,

i have a question abount policy match.

I have sniffed packets from fortigate CLI and the result is:

6.891062 port3 in 195.xx.xxx.xx -> 172.xx.xx.xxx: icmp: echo request
7.892226 port3 in 195.xx.xxx.xx -> 172.xx.xx.xxx: icmp: echo request
8.892875 port3 in 195.xx.xxx.xx -> 172.xx.xx.xxx: icmp: echo request

So I created a firewall policy having as source port3 and source ip address 195.xx.xxx.xx and as destination 172.xx.xx.xxx with service ICMP_ALL. But the policy not match.

Any suggestion?

Thanks for the support

[Toshi_Esumi · Accepted solution]

For a policy route to work, there need to be a proper route existing toward the same outgoing interface in the routing table.

For examiple, if two 0/0 routes to wan1 and wan2 exist, you can set two policy routes for one group of IPs to use wan1 for like 8.8.8.8/8.8.4.4 and another group of IPs to use wan2 for the same DNS servers.

But if there is only one 0/0 route to wan1, and no route toward wan2, the second group won't be able to reach the DNS servers. It wouldn't be able to use wan1 either because the policy route "sticks" and won't let it follow the 0/0 route.

Toshi