Hot!Policy route for some IP Address

Author
pawanrohilla1984
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/10/08 10:11:42
  • Status: offline
2018/10/10 18:17:00 (permalink)
0

Policy route for some IP Address

hi,
 
i have Fortigate 60E firewall with 5.4.10 Version. WAN1 Leases line connection with static ip address. WAN2 local ip through DSL router.
i want some ip address's (192.168.1.11-15, 5 ip address) traffic should go through from WAN2 and rest traffic should go from default WAN1.
Static route configuration
WAN1  Distance 10 Priority 10
WAN2  Distance 10 Priority 20
 
while creating policy route, it is not showing "Source Address" option.
 
how can enable source address in policy route or any alternate way to configure the same?
 
Thanks
 
#1

10 Replies Related Threads

    Fullmoon
    Platinum Member
    • Total Posts : 790
    • Scores: 7
    • Reward points: 0
    • Joined: 2010/08/02 18:02:10
    • Status: offline
    Re: Policy route for some IP Address 2018/10/10 22:59:15 (permalink)
    0
    this can be done through Policy Route

    Fortigate Newbie
    #2
    pawanrohilla1984
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/10/08 10:11:42
    • Status: offline
    Re: Policy route for some IP Address 2018/10/11 17:46:08 (permalink)
    0
    i think this is not possible through policy route. 
    When i add a policy route with source as 192.168.1.11/24, 192.168.1.12/24...... 192.168.1.15/24, it is creating policy route for entire subnet 192.168.1.0.
    so all traffic start going from WAN2.
    we can route traffic for any port or protocol but we can't route traffic for IP Address range.
     
    i think this is loose point in Fortinet.
     
    If anyone have done this, can i have step by step configuration for creating policy route?
    post edited by pawanrohilla1984 - 2018/10/11 18:24:40
    #3
    tanr
    Platinum Member
    • Total Posts : 610
    • Scores: 20
    • Reward points: 0
    • Joined: 2016/05/09 17:09:43
    • Status: offline
    Re: Policy route for some IP Address 2018/10/11 20:50:50 (permalink)
    0
    By specifying 192.168.1.X/24 your specifying the whole 192.168.1.0/24 subnet regardless of X.
    #4
    pawanrohilla1984
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/10/08 10:11:42
    • Status: offline
    Re: Policy route for some IP Address 2018/10/11 22:05:41 (permalink)
    0
    so, what to specify in "source field" to enable this policy for particular IP address range?
    i want to create policy for 192.168.1.11 to 15 (5 IP Address) not for whole subnet.
     
    any idea...!
     
     
     
    #5
    tanr
    Platinum Member
    • Total Posts : 610
    • Scores: 20
    • Reward points: 0
    • Joined: 2016/05/09 17:09:43
    • Status: offline
    Re: Policy route for some IP Address 2018/10/11 22:44:21 (permalink)
    0
    You can use a subnet calculator like https://www.ipaddressguide.com/cidr to calculate them.

    The range you specified would actually be two cidr ranges, so won’t work directly.
    You can create address objects on the FortiGate that’s are ranges (instead of subnets with masks) though and may be able to use the address objects.
    #6
    pawanrohilla1984
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/10/08 10:11:42
    • Status: offline
    Re: Policy route for some IP Address 2018/10/11 23:18:36 (permalink)
    0
    hi Tanr,
     
    Thanks for reply..
    in Fortinet 60E with firmware 5.4.x, there are no option for address object while creating policy route.
    it is giving option for source field only. and it will accept only subnet not the ip address range.
    #7
    Sudarsan Babu
    Bronze Member
    • Total Posts : 45
    • Scores: 2
    • Reward points: 0
    • Joined: 2017/04/24 03:18:50
    • Location: INDIA
    • Status: offline
    Re: Policy route for some IP Address 2018/10/12 03:55:51 (permalink)
    0
    Hi can you try in cli. 
     
    In cli 
     
    config router policy 
    edit 1 
    set input-device "internal" 
    set src "x.x.x.x "                ------------->   Internal Subnet
    set dst "0.0.0.0/0.0.0.0" 
    set gateway  Y.Y.Y.Y           ------------->   WAN 
    set output-device "wan2" 
    end 

    Regards,
    Sudarsan Babu P
    #8
    tanr
    Platinum Member
    • Total Posts : 610
    • Scores: 20
    • Reward points: 0
    • Joined: 2016/05/09 17:09:43
    • Status: offline
    Re: Policy route for some IP Address 2018/10/12 09:19:07 (permalink)
    0
    You’ll have to just use a subnet then - perhaps changing some of those IPs to fit.
    #9
    sw2090
    Gold Member
    • Total Posts : 202
    • Scores: 10
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: Policy route for some IP Address 2018/10/15 00:12:09 (permalink)
    0
    The most easiest way might be this:
     
    - create an ip range object for 192.168.1.11-15
    - create a policy: source interface is where your 192.168.1.0/24 resides. Destination WAN2. Source is the range object you created above, destination any, service any.
    - make sure this policy comes BEFORE the other internet policies to have it be the first that matches. 
     
    Then traffic from out 192.168.1.11-15 to the internet will match this policy and go to WAN2 and all other traffic from 192.168.1.0/24 will match some other policy and go to WAN1.
    #10
    Fullmoon
    Platinum Member
    • Total Posts : 790
    • Scores: 7
    • Reward points: 0
    • Joined: 2010/08/02 18:02:10
    • Status: offline
    Re: Policy route for some IP Address 2018/10/15 00:52:37 (permalink)
    0
    pawanrohilla1984
    in Fortinet 60E with firmware 5.4.x, there are no option for address object while creating policy route.
    it is giving option for source field only. and it will accept only subnet not the ip address range.

     

    Go to System>Feature Visibility>Advanced Routing (Turned on the radio button).
     
    See the attached file on how to create PBR rule.
     

    Attached Image(s)


    Fortigate Newbie
    #11
    Jump to:
    © 2018 APG vNext Commercial Version 5.5