Policy route for some IP Address

[pawanrohilla1984]

hi,

i have Fortigate 60E firewall with 5.4.10 Version. WAN1 Leases line connection with static ip address. WAN2 local ip through DSL router.

i want some ip address's (192.168.1.11-15, 5 ip address) traffic should go through from WAN2 and rest traffic should go from default WAN1.

Static route configuration

WAN1  Distance 10 Priority 10

WAN2  Distance 10 Priority 20

while creating policy route, it is not showing "Source Address" option.

how can enable source address in policy route or any alternate way to configure the same?

Thanks

[Fullmoon]

this can be done through Policy Route

[pawanrohilla1984]

i think this is not possible through policy route. 

When i add a policy route with source as 192.168.1.11/24, 192.168.1.12/24...... 192.168.1.15/24, it is creating policy route for entire subnet 192.168.1.0.

so all traffic start going from WAN2.

we can route traffic for any port or protocol but we can't route traffic for IP Address range.

i think this is loose point in Fortinet.

If anyone have done this, can i have step by step configuration for creating policy route?

[tanr]

By specifying 192.168.1.X/24 your specifying the whole 192.168.1.0/24 subnet regardless of X.

[pawanrohilla1984]

so, what to specify in "source field" to enable this policy for particular IP address range?

i want to create policy for 192.168.1.11 to 15 (5 IP Address) not for whole subnet.

any idea...!

[tanr]

You can use a subnet calculator like [link]https://www.ipaddressguide.com/cidr[/link] to calculate them. The range you specified would actually be two cidr ranges, so won’t work directly. You can create address objects on the FortiGate that’s are ranges (instead of subnets with masks) though and may be able to use the address objects.

[pawanrohilla1984]

hi Tanr,

Thanks for reply..

in Fortinet 60E with firmware 5.4.x, there are no option for address object while creating policy route.

it is giving option for source field only. and it will accept only subnet not the ip address range.

[Fullmoon]

pawanrohilla1984 wrote:

in Fortinet 60E with firmware 5.4.x, there are no option for address object while creating policy route.

it is giving option for source field only. and it will accept only subnet not the ip address range.

Go to System>Feature Visibility>Advanced Routing (Turned on the radio button).

See the attached file on how to create PBR rule.

[Sudarsan_Babu]

Hi can you try in cli.    In cli    config router policy  edit 1  set input-device "internal"  set src "x.x.x.x "                ------------->   Internal Subnet set dst "0.0.0.0/0.0.0.0"  set gateway  Y.Y.Y.Y           ------------->   WAN  set output-device "wan2"  end 

[tanr]

You’ll have to just use a subnet then - perhaps changing some of those IPs to fit.