I have an scenario where a Fortigate firewall is used to separate internal networks from the Internet (FortiOS Version 4.0 MR3 patch 11). Right now there is a single Internet connection attached to the firewall and a default static route is used to get all Internet traffic through it. I would like to attach a second Internet connection to the firewall and then route only certain traffic through it, for example web browsing traffic.
For this setup, I keep the current static default route through the first link and then configure policy routing options in order to route traffic with destination port TCP/80 and TCP/443 through the second Internet link. As expected, policy routing is evaluated before routing table and all traffic destined to TCP/80 and TCP/443 is sent through to second link, including traffic between subnets directly connected to the Fortigate, what breaks communication between them.
In a Cisco environment I would adjust the ACL used to match traffic for policy routing, denying traffic between internal networks at the beginning of the ACL and adding a "permit any" statement at the end. However, I can not find the way to instruct the Fortigate to work in a similar manner.
Do you know how to make this scenario working with Fortigate?