Policy route and default gateway

[anru]

Hi all, I have two different public IPs defined on my Fortigate 600C but a single default gateway. I' d like that traffic coming from IP1 replies with IP1 gw and traffic coming from IP2 replies with IP2 gw. I try to define a policy route, but it doesn' t work. Please see details on image attached. Thanks for your expert advice!

[Jan_Scholten]

Read the manuals? It is afaik in advanced routing on docs.fortinet.com or kb: e.g. http://kb.fortinet.com/kb/viewContent.do?externalId=FD31240&sliceId=1 (here are debvug commands as well to check the behavior) long story short: Add a default gateway to 2.3.4.6 with same metric, higher priority. This enables that traffic can leave this interface as well (e.g. no asymetric routing needed), but traffic defaults to 7.8.9.11 Now that you have both routes in your routing table (but because of higher priority on 2.3.4.6 only the other is used), you can set a policy route towards 2.3.4.6

[anru]

Ok, I defined a default route via 2.3.4.6 with higher priority. Now, what policy route do I have to define to reply all requests coming from port10 via gateway 2.3.4.6? Does the following route is right? - Protocol: ANY - Incoming interface: port 10 - Source address: 0.0.0.0/0 - Destination address: 0.0.0.0/0 - Outgoing interface: port 10 - Gateway address: 2.3.4.6 Thanks!!

[Jan_Scholten]

If you have a default gateway with same metric but higher priority you don' t need anything. traffic that enters via port 10 will leave via port 10 (because it learned the session) check debug flow output: diag debug enable diag debug flow show console enable diag debug flow filter addr <IPtoSee> diag debug flow trace start 50 you only need policy routing if you want to force traffic leaving you fortigate via port 10. E.g.: Now all your traffic originating from internal towards internet heading will leave via port 12 (default route, best/lowest priority). Now you want to force smtp traffic leaving your fgt towards port10: - Protocol: TCP - Incoming interface: internal - Source address: 10.10.10.0/24 - Destination address: 0.0.0.0/0 - SourcePorts any - DestinationPorts 25 - Outgoing interface: port 10 - Gateway address: 2.3.4.6 This will override the normal route (via Port 12) for traffic to Port 25 (smtp). Try something like that and do the debug commands, where you can see what exactly happens to your traffic. you may want/need to clear sessions to force visibility of a new connection

[anru]

Thanks a lot, now it works fine!