Fortinet Gate 60D, Administration Manual, Page: 285 / 706

Router Static Policy Route
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424
285
http://docs.fortinet.com/ • Feedback
Figure 166: Edit Static Route
Policy Route
A routing policy allows you to redirect traffic away from a static route. This can be useful if
you want to route certain types of network traffic differently. You can use incoming traffic’s
protocol, source address or interface, destination address, or port number to determine
where to send the traffic. For example, generally network traffic would go to the router of a
subnet, but you might want to direct SMTP or POP3 traffic addressed to that subnet
directly to the mail server.
If you have configured the FortiGate unit with routing policies and a packet arrives at the
FortiGate unit, the FortiGate unit starts at the top of the Policy Route list and attempts to
match the packet with a policy. If a match is found and the policy contains enough
information to route the packet (a minimum of the IP address of the next-hop router and
the FortiGate interface for forwarding packets to it), the FortiGate unit routes the packet
using the information in the policy. If no policy route matches the packet, the FortiGate unit
routes the packet using the routing table.
Policy route options define which attributes of a incoming packet cause policy routing to
occur. If the attributes of a packet match all the specified conditions, the FortiGate unit
routes the packet through the specified interface to the specified gateway.
Figure 167 shows the policy route list belonging to a FortiGate unit that has interfaces
named “external” and “internal”. The names of the interfaces on your FortiGate unit may
be different.
To edit an existing policy route, see “Adding a policy route” on page 286 .
Destination
IP/Mask
Type the destination IP address and network mask of packets that the
FortiGate unit has to intercept. The value
0.0.0.0/0.0.0.0
is reserved
for the default route.
Gateway Type the IP address of the next-hop router to which the FortiGate unit will forward
intercepted packets.
Device Select the name of the FortiGate interface through which the intercepted packets
may be routed to the next-hop router.
Distance Type an administrative distance from 1 to 255 for the route. The distance value is
arbitrary and should reflect the distance to the next-hop router. A lower value
indicates a more preferred route.
Note: Most policy settings are optional, so a matching policy alone might not provide
enough information for forwarding the packet. The FortiGate unit may refer to the routing
table in an attempt to match the information in the packet header with a route in the routing
table. For example, if the outgoing interface is the only item in the policy, the FortiGate unit
looks up the IP address of the next-hop router in the routing table. This situation could
happen when the interfaces are dynamic (such as DHCP or PPPoE) and you do not want
or are unable to specify the IP address of the next-hop router.