Fortinet FortiGate-800 User Manual download pdf (Page 55)

NAT/Route mode installation Configuration example: Multiple connections to the Internet

FortiGate-800 Installation and Configuration Guide 55

Policy routing examples

Adding policy routing increases your control over how packets are routed. Policy

routing works on top of destination-based routing. To increase the control provided by

destination-based routing, configure destination-based routing first and then build

policy routing on top.

For example, if you use destination-based routing to configure routing for dual Internet

connections, you can use policy routing to better control which traffic is sent to which

destination route. This section describes the following policy routing examples, based

on topology similar to that shown in Figure 9 on page 51. Differences are noted in

each example.

The policy routes described in these examples work only if you have already defined

destination routes similar to those described in the previous section.

• Routing traffic from internal subnets to different external networks

• Routing a service to an external network

For more information about policy routing, see “Policy routing” on page 156.

Routing traffic from internal subnets to different external networks

If the FortiGate unit provides Internet access for multiple internal subnets, you can use

policy routing to control the route that traffic from each network takes to the Internet.

For example, if the internal network includes the subnets 192.168.10.0 and

192.168.20.0 you can enter the following policy routes:

1 Enter the following command to route traffic from the 192.168.10.0 subnet to the

100.100.100.0 external network:

set system route policy 1 src 192.168.10.0 255.255.255.0 dst

100.100.100.0 255.255.255.0 gw 1.1.1.1

2 Enter the following command to route traffic from the 192.168.20.0 subnet to the

200.200.200.0 external network:

set system route policy 2 src 192.168.20.0 255.255.255.0 dst

200.200.200.0 255.255.255.0 gw 2.2.2.1

Routing a service to an external network

You can use the following policy routes to direct all HTTP traffic (using port 80) to one

external network and all other traffic to the other external network.

1 Enter the following command to route all HTTP traffic using port 80 to the next hop

gateway with IP address 1.1.1.1.

set system route policy 1 src 0.0.0.0 0.0.0.0 dst 0.0.0.0

0.0.0.0 protocol 6 port 80 80 gw 1.1.1.1

2 Enter the following command to route all other traffic to the next hop gateway with IP

address 2.2.2.1.

Set system route policy 2 src 0.0.0.0 0.0.0.0 dst 0.0.0.0

0.0.0.0 gw 2.2.2.1

1 2 ... 50 51 52 53 54 55 56 57 58 59 60 ... 335 336

No comments

Fortinet FortiGate-800 User Manual Page 55