Policy Routing LAB:
Management Interface Configuration
FortiGate-VM64-KVM # config system interface
FortiGate-VM64-KVM (interface) # edit port3
FortiGate-VM64-KVM (port3) # set mode dhcp
FortiGate-VM64-KVM (port3) # set allowaccess http https ssh telnet ping
FortiGate-VM64-KVM (port3) # end
R1 Configuration
R1(config)#interface e0/0
R1(config-if)#ip address [Link] [Link]
R1(config-if)#no shutdown
R1(config)#interface loopback 1
R1(config-if)#ip address [Link] [Link]
R1(config)#ip route [Link] [Link] [Link]
R1(config)#line vty 0 4
R1(config-line)#password 123
R1(config-line)#transport input all
R1(config-line)#exit
R1(config)#enable password 123
R1(config)#ip http server
R1(config)#ip http secure-server
R1(config)#username admin privilege 15 password 123
1 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717
R2 Configuration
R2(config)#interface e0/0
R2(config-if)#ip address [Link] [Link]
R2(config-if)#no shutdown
R2(config)#interface loopback 1
R2(config-if)#ip address [Link] [Link]
R2(config)#ip route [Link] [Link] [Link]
R2(config)#line vty 0 4
R2(config-line)#password 123
R2(config-line)#transport input all
R2(config-line)#exit
R2(config)#enable password 123
R2(config)#ip http server
R2(config)#ip http secure-server
R2(config)#username admin privilege 15 password 123
2 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717
Policy Route:
Go to Select Network>Policy Routes > Create New lets create a policy route to send only http
(port-80) traffic for [Link] network to next hop or gateway [Link] rest of all traffic will go
normally base on Static route which is next hop [Link].
3 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717
TCP Transmission Control Protocol
UDP User Datagram Protocol
SCTP Stream Control Transmission Protocol
Any Any Protocol
Specify Specify manually from 0 to 255 any protocols number.
Protocol Select from existing or specify the protocol number to match. The range is
from 0 to 255. A value of 0 disables the feature. Commonly used Protocol
settings include 6 for TCP, 17 for UDP sessions & 1 for ICMP sessions.
Incoming Select the name of the interface through which incoming packets subjected
Interface to the policy are received.
Source To perform policy routing based on IP source address, type the source
Address / address and network mask to match. A value of [Link]/[Link] disables the
Mask feature.
Destination To perform policy routing based on the IP destination address of the packet,
Address / type the destination address and network mask to match. A value of
Mask [Link]/[Link] disables the feature.
Destination To perform policy routing based on the port on which the packet is received,
Ports type the same port number in the From and To fields. To apply policy routing
to a range of ports, type the starting port number in the From field and the
ending port number into field. A value of 0 disables this feature. Destination
Ports fields are only used for TCP & UDP protocols. Skipped over for all.
Type of Use a two-digit hexadecimal bit pattern to match the service or use a two-
Service digit hexadecimal bit mask to mask out.
Outgoing Select the name of the interface through which packets affected by the
Interface policy will be routed.
Gateway Type the IP address of the next-hop router that the FortiGate unit can access
Address through the specified interface.
Finally, the policy route look like below.
4 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717
After applying the policy route only HTTP means port 80 is going to Destination R2 [Link].
While from the same system rest of all traffic is going through destination R1 [Link].
The traceroute also show next hope is [Link]
5 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717