POLICY ROUTES FORTIGATE

 Policy routes also referred to as policy based routing is a very popular technique that routes the incoming packets based on the set of policy defined. The policy usually defines that the packet from particular source are routed to particular gateway. 

Simply not trying to make it theoretically lengthy lets try this feature out in Fortigate.

In our particular scenario there are 2 fortigate boxes residing in HA (Active/Passive) mode. There are two upstream ISP connected with the fortigate box one named after port 1 SUBISU and the other being port 2  WEBSURFER. We have two internal gateways which contains subnet of 172.16.0.0/28 and the other one being 172.16.0.16/28. We will be leveraging the privilege of policy route and send the packet incoming from 172.16.0.0/28 subnet towards Websurfer upstream and the packet coming from 172.16.0.16/28 subnet towards SUBISU upstream which will help us on utilizing both the links making it more efficient usage of bandwidth.

We will need to create two default routes towards our upstream ISP's .For the redundant Internet connections, both the default static routes have to be active in the routing table.So, in order to achieve it, set the distance of both the routes the same and also be aware that priority must be equal.

Example : 

wan1 has a distance of 10 and a priority of 0.

wan2 has a distance of 10 and a priority of 0.

This is very important in our scenario as we are going to utilize both the links which will provide us maximum utilization of both the ISP's bandwidth rather than setting up making the other link idle waiting for the primary link to fail.

In case of active failover scenario, if wan1 is to be the primary link [active link], then set the lowest priority to that link.And highest priority to the other wan interface. When there are multiple routes to the same destination with the same distance then the priority will be checked. And the route with the least priority will be given the preference.

Example:

wan1 has a distance of 10 and a priority of 0.

wan2 has a distance of 10 and a priority of 10.

Here wan1 will be a selected route, as it has the least priority compared to wan2.

So, all the traffic will be handled by wan1. If wan1 goes down then the traffic will be shifted to wan2.

Let's now begin our configuration for policy route.

1. Creating a static route ( Active/ Active) 

The image above displays a default route towards 103.232.152.81 being the gateway of the upstream ISP SUBISU with an administrative distance value of 10 and priority being 0.

The image above displays a default route towards 118.91.170.241 being the gateway of the upstream ISP WEBSURFER with an administrative distance value of 10 and priority being 0.

We will now need to verify whether both the routes exists in the routing table or not. We can simply check using get router info routing-table all command in the cli of the firewall.

We can see that both the route does exists on the routing table of the firewall.

2. Creating a policy route 

We will need to create a policy route for the subnet 172.16.0.0/28 IP being 172.16.0.2. The end host from 172.16.0.2 will simply go towards the websurfer ISP by checking the policy routes made on the firewall. Under Network tab click on Policy Routes.

We can match the incoming traffic based on protocol, incoming interface, source address, destination address etc. Finally, we will need to create a policy for the those two subnet.

3. Creating a Policy

Policy for SSF subnet (172.16.0.0/28) needs  to be created where my outgoing interface should be port2 WEBSURFER. Services and NAT has been allowed accordingly.

The other policy would be for SSF subnet and its outgoing interface being port 1 SUBISU upstream.

4. Verification

We can simply verify this going under Fortiview > Policies. As you can see in the below image that SOSYS is routing packets from WAN-SUBISU (port1) and SSF Subnet is routing packets from WAN-WEBSURFER (port2)

Relentless growth of cloud computing, mobility, and Web-based applications requires that the network know each application traffic type traversing the network. Policy route can also handles each application type separately to effectively prioritize, segregate, and route traffic without compromising performance or availability.