Why Policy-Based Routing May Be Overridden by Firewall Policy
A FortiGate with multiple WAN interfaces uses policy-based routing (PBR) to route traffic from subnet 10.0.0.0/24 through port1 and 10.0.1.0/24 through port2. However, traffic from 10.0.0.0/24 is still using port2. The PBR rule appears correctly configured. What is the MOST likely issue?
Quick Answer
The answer is that the firewall policy for the traffic from 10.0.0.0/24 has a route override setting enabled, which bypasses the policy-based routing rule. This happens because, on a FortiGate, policy-based routing is evaluated before the routing table lookup, but if the matching firewall policy explicitly overrides the route—often via the "set route-ttl" or a static route tied to the policy—the PBR decision is discarded. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this question tests your understanding of the interaction between PBR and firewall policies, a common trap where candidates assume PBR alone controls the path. The key insight is that a firewall policy with its destination interface set to "auto" or a specific port can silently override PBR, especially when the policy's routing action is not set to "use policy-based routing." Remember the mnemonic: "PBR picks the path, but the policy can pull the plug."
⚠ Common exam trap
Candidates often assume PBR always takes precedence over static routes, but FortiGate's firewall policy 'route override' setting can silently bypass PBR, making it a hidden pitfall in multi-WAN configurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall policy for that traffic has a route override setting that bypasses PBR
The 'route override' setting in a firewall policy allows the FortiGate to ignore policy-based routing (PBR) rules for matching traffic. When enabled, the firewall policy uses the routing table (e.g., static or dynamic routes) instead of PBR, which explains why traffic from 10.0.0.0/24 is still using port2 despite a correctly configured PBR rule. This is a common misconfiguration where PBR appears correct but is overridden by the firewall policy's route override option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The source subnet in the PBR rule is incorrectly specified as 10.0.1.0/24
Why it's wrong here
The admin confirmed it's correct.
- ✓
The firewall policy for that traffic has a route override setting that bypasses PBR
Why this is correct
If the policy has an explicit route override (like setting the outgoing interface), it will bypass PBR. Disabling route override allows PBR to work.
- ✗
The static route for 0.0.0.0/0 has a higher administrative distance than the PBR rule
Why it's wrong here
PBR is processed before route table lookup, so administrative distance does not affect PBR.
- ✗
The PBR rule has a higher priority number than other rules
Why it's wrong here
Priority numbers determine order; lower number is higher priority.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate with multiple WAN interfaces uses policy-based routing (PBR) to route traffic from a specific subnet out of a particular interface. The admin also has a firewall policy allowing that subnet to the internet. However, the traffic is not being routed as expected. What could be the issue?
hard- A.The firewall policy is placed above the PBR rule
- B.The PBR rule does not have a matching protocol or service defined
- ✓ C.The PBR rule uses an incorrect source or destination address
- D.The FortiGate is in transparent mode
Why C: Policy-based routing (PBR) is evaluated before firewall policies. If the PBR rule specifies an incorrect source or destination address, traffic from the intended subnet will not match the PBR rule and will fall through to the default routing table, potentially exiting via a different interface. The firewall policy alone cannot override the routing decision; the PBR rule must correctly identify the traffic to steer it to the desired egress interface.
Variation 2. What is the purpose of policy-based routing (PBR) in FortiGate?
easy- A.To load balance traffic across multiple WAN links
- B.To filter traffic based on application signatures
- ✓ C.To route traffic based on source address, destination, or other attributes instead of the routing table
- D.To authenticate users before allowing traffic
Why C: Policy-based routing (PBR) in FortiGate allows you to override the default routing table lookup by forwarding traffic based on criteria such as source IP address, destination IP address, protocol, or even application. This is configured under the 'policy route' feature and is evaluated before the routing table, enabling granular control over traffic paths that static or dynamic routes cannot provide.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.