9

I have an scenario where a Fortigate firewall is used to separate internal networks from the Internet (FortiOS Version 4.0 MR3 patch 11). Right now there is a single Internet connection attached to the firewall and a default static route is used to get all Internet traffic through it. I would like to attach a second Internet connection to the firewall and then route only certain traffic through it, for example web browsing traffic.

For this setup, I keep the current static default route through the first link and then configure policy routing options in order to route traffic with destination port TCP/80 and TCP/443 through the second Internet link. As expected, policy routing is evaluated before routing table and all traffic destined to TCP/80 and TCP/443 is sent through to second link, including traffic between subnets directly connected to the Fortigate, what breaks communication between them.

In a Cisco environment I would adjust the ACL used to match traffic for policy routing, denying traffic between internal networks at the beginning of the ACL and adding a "permit any" statement at the end. However, I can not find the way to instruct the Fortigate to work in a similar manner.

Do you know how to make this scenario working with Fortigate?

Improve this question
5

Since policy routes are evaluated top-down, you can work around this limit by placing a more specific entry matching traffic from internal subnet A to internal subnet B.

However, this should be less than comfortable if you have many different networks attached to your internal interface.

In this case, I would recommend you a trick I once used: since Fortigate devices ignore QoS marks, you should sign your "internet" packets on the firewall-facing port of your Cisco switch with a specific TOS and then use that mark in your policy-route.

Improve this answer
7

From Network Labs blog:

"In case of a Fortinet firewall, its Policy Route:
CLI version:

config router policy
    edit 1
        set input-device "port4"
        set src 172.18.0.0 255.255.0.0
        set dst 192.168.3.0 255.255.255.0
        set protocol 6
        set start-port 443
        set end-port 443
        set gateway 1.1.1.1
        set output-device "port3"
    next
end

For the GUI version, check the blog above. Can't post images until I get 10 rep points. :-/

Improve this answer
3
  • One of the matching conditions for this example is that source address falls into 172.18.0.0/16 and destination address into 192.168.3.0/24. I wonder how to configure "source address falls into 172.18.0.0/16 and destination address falls into any subnet except 192.168.3.0/24" – Daniel Yuste Aroca May 16 '13 at 18:26
  • Create an ACL that denies 172.18.0.0/16 source to 192.168.3.0/24 destination. Then, the above statement you would change the destination where you want 443 to go. – sigwo May 17 '13 at 3:01
  • AFAIK, ACLs are evaluated prior to PBRs. So the ACL would deny the traffic, then the PBR would take care of routing the 443 traffic to your desired interface/route. – sigwo May 17 '13 at 3:03
3

Yes! you can make it possibly as per your requirement I understand that your want web -browsing traffic ie is tcp-80 & tcp-443 outbound traffic wants to flow from secondary internet link . And primary internet link will use remaining traffic other thàn web -traffic to configure this requirement .

  1. policy - routing will have priority then default route as we know..

Create two outbound security policies for internet access for both isps

Assume

Port11 -first internet link

Port8 - second internet link

Port5 -Lan interface

Create policy for secondary internet link

Source interface : Lan Destination interface :port8 Source address : Any Destination :address :any Service : http &https Action : allowed Security profiles : on

Create policy for primary link

Source interface :Lan Destination interface : port 11 Source address :any Destination address :any Services : any Action allowed Security profiles :on

Keep secondary internet link policy on top Now create policy based route

Às source as : Lan subnet Destination :any Interface : Port 8 Action :allow

And then configure default route as

Ip route 0.0.0.0 0.0.0.0 pointing towards first isp gateway ip route 0.0.0.0 0.0.0.0 pointing towards second isp gateway

Let's see now traffic flow

Any user àccessing internet from LAN will first check policy based routing if ip matches packet will be send to policy of secondary link as per policy if traffic is 80 and 443 is allowed ànd other traffic is second on second policy that is first internet link policy .. in this you can configure your requirement all 80 and 443 traffic will flow from secondary link and remaining traffic will flow from first internet link unwanted traffic will be denied in implicitly deny policy at bottom... Like wise you can configure your requirement..

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.