Policy Based Routing

[Gabana]

hello all

does policy based routing work on the interface of the firewall ?

for example if we need to accept connection to an interface on the firewall and then send it back to the next hop on that interface (not the default route on the other interface)

can we use PBR here ?

[Toshi_Esumi]

You still need to have a route for the destination toward the interface the PBR is pointing to. PBR picks one out of multiple routing options based on other factors such as source interface, addresses, protocaol, etc.

[Gabana]

so you mean can we use PBR or not ?

[Toshi_Esumi]

Depending on how you configure. See the example at KB below. This FGT has two static default routes with different priority. The PBR re-direct a specific outbound traffic toward the low priority interface/ISP.

http://kb.fortinet.com/kb/viewContent.do?externalId=FD31240

[j_a_m_e_s]

Toshi,

Are you saying that in order to use PBR on Fortigate, you need to match a PBR policy as well as matching a RIB entry with the DST IP header of the ingress packet? I found this in the Fortigate handbook:

In fact, the FortiGate almost always requires a matching route in the routing table in order to use a policy route.

This seems like a shame. I would ideally like to say "all packets received on IF X should route to IF Y" and vice versa. I would like to do this across 20 - 30 vdoms and not have to set up route peerings for each one.

Regards

James.