Routing Issue

[create_share]

Hi,

My LAN Users are not able to reach the network behind DMZ Interface due to the route to the internet

0.0.0.0/0.0.0.0 to WAN. I added the route for DMZ Subnets but the users' machines are still taking the internet route. LAN Users' default gateway is the core switch and not the firewall.

LAN Users Subnet: 10.10.1.0/24

LAN Users Default GW: 10.10.1.1 (Core Switch)

Fortigate LAN Int: 10.10.1.2

Fortigate DMZ Int: 192.168.1.2

Fortigate DMZ GW: 192.168.1.1 (Cisco Router)

Once I disable the WAN Interface, users are able to reach the DMZ Subnets.

Thanks.

[knagaraju]

Hello,

Please get the outputs of the below commands from FortiGate cli
get router info routing-table details 10.10.1.1
get router info routing-table details 192.168.1.1
get router info routing-table database

Regards
Nagaraju.

[create_share]

deleted

[create_share]

deleted

[create_share]

I don't know why my reply is being deleted. I am pasting the output again.

Routing table for VRF=0
Routing entry for 10.10.1.0/24
Known via "static", distance 10, metric 0
10.10.1.1, via port1 inactive

Best selected route:
Routing entry for 0.0.0.0/0
Known via "static", distance 10, metric 0, best
* wan1 DG, via port2
wan2 DG, via port3 inactive

Routing table for VRF=0
Routing entry for 192.168.1.0/24
Known via "connected", distance 0, metric 0, best
* is directly connected, port5

Routing entry for 192.168.1.0/24
Known via "static", distance 10, metric 0
192.168.1.1, via port5

get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
> - selected route, * - FIB route, p - stale info

Routing table for VRF=0
S *> 0.0.0.0/0 [10/0] via wan1 GW, port2, [1/0]
> [10/0] via wan2 GW, port3 inactive, [1/0]

S 10.10.1.0/24 [10/0] via 10.10.1.1, port1 inactive, [1/0]
S *> 10.10.20.0/24 [10/0] via Branch1 tunnel branch wan ip, [1/0]
S *> 10.10.21.0/24 [10/0] via Branch2 tunnel branch wan ip, [1/0]
C *> 192.168.1.0/24 is directly connected, port5
S 192.168.1.0/24 [10/0] via 192.168.1.1, port5, [1/0]
S 10.154.0.0/24 [10/0] via 10.10.1.1, port1 inactive, [1/0]