Policy route for SMTP traffic out

[#1]

HI, We have a 60b firewall with 1 WAN connection that has a block of 8 IP addresses assigned to it. The IP address being used as the gateway is : 217.155.85.254 We want to use 217.155.85.251 for sending SMTP traffic as there was a bit of a blunder with our mail relay when adding the domains, when we added them it used the IP address the current MX record pointed and automatically added it to the relays allowed list. The issue is that the MX pointed to 217.155.85.251 and our firewall is sending from 217.155.85.254, and being blocked. I' ve raised a ticket with them to add the full range of addresses but wanted to know how to work this out locally on the firewall, as I' m pretty sure it can be done and don' t like being beaten (even though you could consider asking for help being beaten ;)) I tried the following: Setup a policy route; protocol: 6 incoming interface: switch Source address / mask: 192.168.30.0/24 destination address / mask: 0.0.0.0/0.0.0.0 destination ports: from (25) to (25) force traffic to: outgoing interface: WAN1 Gateway address: 217.155.85.251 This broke SMTP out. I read in the manual that its possible to add another address in the same range as the default gateway and it should work. but no. Anyone know how to make this work?

[ede_pfau]

did you configure the ippool on the zone then, or on the interface ' wan1' ?

[#3]

The zone isnt available when adding the ip pool

[Maik]

compare FortiOS Versions. I remember in V3 IPPools were a no go for me to use Zones for External Interfaces.

[ede_pfau]

So that answers this. Like you said, delete the zone and use the interface instead. Alternatively, upgrade to 4.00MR1 patch 8...but this possibly brings along side effects. The zone isn' t used anymore anyway. just my 2 cents.

[Maik]

The zone isn' t used anymore anyway.

why not? I like zones :)

[#7]

Currently running v4.0.3,build0106,090616

[ede_pfau]

@Maik:

WAN1 and WAN2 are members of the ' External' Zone because there were 2 WAN links at one point.

I' ve got nothing against zones in general but here it' s not used anymore. @Paul: OK I see you' re running 4.0.3 so that isn' t far from 4.1.8. Again, your decision. IMHO one shouldn' t keep obsoleted configurations.

[#9]

I agree, I' ll wait for later when the office is dead and rip out the zone, its not needed anyway :) Thanks all.

[#10]

I' ve just realised what' s involved here, will have to be an onsite job and will have to wait. If I upgrade the firmware will the current rules that are using the zone then break?

[ede_pfau]

No, why? Have a look at the Release Notes before upgrading, always. Running 4.1.8 you should then be able to create an IPpool that is not attached to an interface, and thus usable with a zone. (I haven' t done that before but Maik has.)