Policy routes
Policy routing allows you to specify an interface to route traffic. This is useful when you need to route certain types of network traffic differently than you would if you were using the routing table. You can use the incoming traffic's protocol, source or destination address, source interface, or port number to determine where to send the traffic. Policy routes are sometimes referred to as Policy-based routes (PBR).
When a packet arrives, the FortiProxy starts at the top of the policy route list and attempts to match the packet with a policy. For a match to be found, the policy must contain enough information to route the packet. At a minimum, this requires the outgoing interface to forward the traffic, and the gateway to route the traffic to. If one or both of these are not specified in the policy route, then the FortiProxy searches the routing table to find the best active route that corresponds to the policy route. If no routes are found in the routing table, then the policy route does not match the packet. The FortiProxy continues down the policy route list until it reaches the end. If no matches are found, then the FortiProxy does a route lookup using the routing table.
Configuring a policy route
In this example, a policy route is configured to send all FTP traffic received at port1 out through port3 and to a next hop router at 10.1.1.1. To route FTP traffic, the protocol is set to TCP (6) and the destination ports are set to 21 (the FTP port).
To configure a policy route in the GUI:
-
Go to Network > Policy Routes and click Create New.
-
Configure the following fields:
Incoming interface
port1
Source Address
0.0.0.0/0.0.0.0
Destination Address
0.0.0.0/0.0.0.0
Protocol
TCP
Destination ports
21 - 21
Outgoing interface
Enable and select port3
Gateway address
10.1.1.1
-
Click OK.
To configure a policy route in the CLI:
config router policy
edit 1
set input-device "port1"
set src "0.0.0.0/0.0.0.0"
set dst "0.0.0.0/0.0.0.0"
set protocol 6
set start-port 21
set end-port 21
set gateway 10.1.1.1
set output-device "port3"
next
end