Weird route behaviour in 5.6

[digimetrica]

Hello, We manage several fortigates and this is the first i am clueless about this issue. I am UNABLE to reach the whole DMZ from the Internal LAN. Wan -> DMZ Works DMZ -> Internal Works (it was a test) LAN -> DMZ doesn't work. Policy was a plain one: Internal -> DMZ all open. We have tried a single pc connected to the internal just to exclude other network devices in the lan. Looking at the Flow debug it seems traffic goes toward default gateway to internet. Even a traceroute, the first step are * * * * I even tried to add static routes to client and it doesn't work, firewall dmz ip is reachable!!! I don't know what else to look at since this is something I do for years and it's easy to implement.

[digimetrica]

I am still waiting for an answer and I expect a lot of tests before realizing it could be a bug.

Anyway I tried to map an Internal IP to a DMZ IP just to see if it works: but it doesn't :(

[digimetrica]

Hello,

Fortinet support solved the problem that is NOT a bug :)

Practically there was a sd-wan rule (Lan_Internal to WAN) preventing the routing FROM internal to go anywhere else.

I don't know which colleague put that rule but I am enraged as a Dragon now :)

To solve this:

1) create a policy rule that override what is in the sd-wan rule

2) delete the sd-wan if not needed and use the FGT as it has always been :)

Thanks for your patience net@work  :)