Troubleshooting FortiGate Policy Route Issues
An administrator configures a policy route to send all traffic from a specific subnet to a different next-hop. However, traffic from that subnet is still using the default route. Which configuration could be causing this?
⚠ Common exam trap
It's easy for candidates to assume policy routes apply globally to all traffic matching the source/destination, forgetting that FortiGate requires the incoming interface to be explicitly specified for policy routes to be evaluated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy route is applied to the wrong incoming interface
Policy routes are evaluated based on the incoming interface of the traffic. If the policy route is applied to the wrong incoming interface, traffic from the specified subnet arriving on a different interface will not match the policy and will instead follow the default route. This is a common misconfiguration where the administrator assumes the policy applies globally rather than per-interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall policy denies the traffic before policy routing
Why it's wrong here
Policy routing is evaluated before firewall policy lookup in FortiOS, so a firewall policy cannot deny traffic prior to the policy route. Even a deny policy is only consulted after the packet has been matched to a route, meaning it cannot preempt a policy route match. Therefore, this is not a valid explanation for why traffic did not follow the policy route.
- ✓
The policy route is applied to the wrong incoming interface
Why this is correct
Policy routes are tied to a specific incoming interface, so if the traffic arrives on a different interface than the one specified in the policy route, the route will never be evaluated. The administrator must confirm that the policy route's incoming interface matches the physical port where the traffic actually enters the FortiGate. Since the policy route is not applied on the wrong interface, the traffic follows the normal routing table, and the intended policy behavior is not observed.
- ✗
The default route has a higher administrative distance
Why it's wrong here
Administrative distance is a metric used to compare static and dynamic routes within the routing table; it has no bearing on policy routes, which take precedence over all routing-table entries. Even if the default route has a higher administrative distance, it only makes that default route less preferred as a regular route, but the policy route is still processed first. Thus, the default route's AD cannot cause the policy route to be bypassed.
- ✗
The policy route destination is set to all
Why it's wrong here
Setting the destination to 'all' expands the policy route's match criteria to any destination IP, making the route more likely to apply, not less. A destination of 'all' would not cause the policy route to be skipped; instead, it would match traffic to any destination, so the issue must originate from another matching parameter such as the source interface or source address. This option is incorrect because it would actually increase the policy route's coverage rather than prevent it from being used.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator configures a policy route to force traffic from a specific source subnet to use a particular WAN interface. After applying the configuration, the traffic still uses the default route. What is the most likely cause?
medium- A.The static default route has a lower administrative distance than the policy route
- B.The FortiGate's VDOM is enabled and the policy route is in the wrong VDOM
- ✓ C.The policy route's incoming interface is incorrectly configured
- D.The policy route has a lower priority than the static default route
Why C: Policy routes are evaluated based on the incoming interface specified in the rule. If the incoming interface is misconfigured (e.g., set to 'any' or the wrong physical interface), the FortiGate will not match the traffic against the policy route, causing it to fall through to the routing table and use the default route. The policy route must explicitly match the interface on which the traffic enters the FortiGate.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.