Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
pawanrohilla1984
New Contributor

Policy route for some IP Address

hi,

 

i have Fortigate 60E firewall with 5.4.10 Version. WAN1 Leases line connection with static ip address. WAN2 local ip through DSL router.

i want some ip address's (192.168.1.11-15, 5 ip address) traffic should go through from WAN2 and rest traffic should go from default WAN1.

Static route configuration

WAN1  Distance 10 Priority 10

WAN2  Distance 10 Priority 20

 

while creating policy route, it is not showing "Source Address" option.

 

how can enable source address in policy route or any alternate way to configure the same?

 

Thanks

 

10 REPLIES 10
Fullmoon
Contributor III

this can be done through Policy Route

Fortigate Newbie

Fortigate Newbie
pawanrohilla1984
New Contributor

i think this is not possible through policy route. 

When i add a policy route with source as 192.168.1.11/24, 192.168.1.12/24...... 192.168.1.15/24, it is creating policy route for entire subnet 192.168.1.0.

so all traffic start going from WAN2.

we can route traffic for any port or protocol but we can't route traffic for IP Address range.

 

i think this is loose point in Fortinet.

 

If anyone have done this, can i have step by step configuration for creating policy route?

tanr
Valued Contributor II

By specifying 192.168.1.X/24 your specifying the whole 192.168.1.0/24 subnet regardless of X.
pawanrohilla1984
New Contributor

so, what to specify in "source field" to enable this policy for particular IP address range?

i want to create policy for 192.168.1.11 to 15 (5 IP Address) not for whole subnet.

 

any idea...!

 

 

 

tanr
Valued Contributor II

You can use a subnet calculator like [link]https://www.ipaddressguide.com/cidr[/link] to calculate them. The range you specified would actually be two cidr ranges, so won’t work directly. You can create address objects on the FortiGate that’s are ranges (instead of subnets with masks) though and may be able to use the address objects.
pawanrohilla1984

hi Tanr,

 

Thanks for reply..

in Fortinet 60E with firmware 5.4.x, there are no option for address object while creating policy route.

it is giving option for source field only. and it will accept only subnet not the ip address range.

Fullmoon

pawanrohilla1984 wrote:

in Fortinet 60E with firmware 5.4.x, there are no option for address object while creating policy route.

it is giving option for source field only. and it will accept only subnet not the ip address range.

 

Go to System>Feature Visibility>Advanced Routing (Turned on the radio button).

 

See the attached file on how to create PBR rule.

 

Fortigate Newbie

Fortigate Newbie
Sudarsan_Babu
Contributor

Hi can you try in cli.    In cli    config router policy  edit 1  set input-device "internal"  set src "x.x.x.x "                ------------->   Internal Subnet set dst "0.0.0.0/0.0.0.0"  set gateway  Y.Y.Y.Y           ------------->   WAN  set output-device "wan2"  end 

Regards,

Sudarsan Babu P

Regards, Sudarsan Babu P
tanr
Valued Contributor II

You’ll have to just use a subnet then - perhaps changing some of those IPs to fit.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors