Description
Policy Based routing example.
A FortiGate-60 with two WAN interfaces that uses policies to direct traffic to a specific interface.
The rules the policies need to implement are:
HTTP and HTTPS traffic should always go out from WAN2.
Policy 1 and 2 in the sample below.VPN traffic should go out through WAN2 (Policy 3).
Note that the source and destination subnets for that particular VPN are specified.
All other traffic should go out WAN1 (Policy 4).
Note.
If the WAN interface is using PPPOE or DHCP, it is better not to specify the gateway in the policy.
In this case, the gateway is taken from the interface setting.
The gateway should be set to 0.0.0.0.
This will ensure that if Ping Server is used, when the failover happens, the policy route will choose the active interface.
# config router policy
edit 1
set end-port 80
set input-device "internal"
set output-device "wan2"
set protocol 6
set start-port 80
next
edit 2
set end-port 443
set input-device "internal"
set output-device "wan2"
set protocol 6
set start-port 443
next
edit 3
set dst 10.0.47.0 255.255.255.0
set input-device "internal"
set output-device "wan2"
set src 10.0.46.0 255.255.255.0
next
edit 4
set input-device "internal"
set output-device "wan1"
next
