Policy-Based Routing for Selective Internet Traffic on FortiGate
An organization has a FortiGate with two internet connections (WAN1 and WAN2). They want traffic to a specific web service (203.0.113.50 port 443) to always exit via WAN2. All other internet traffic should use WAN1. Which feature should be used to achieve this?
Quick Answer
The answer is policy-based routing (PBR), which should be configured with a policy matching the destination IP 203.0.113.50 and service TCP/443 to force that traffic out WAN2. PBR is the correct choice because it allows you to selectively override the default routing table based on criteria like source, destination, or service, ensuring that only specific traffic follows a different path while all other traffic continues to use the regular route via WAN1. On the Fortinet NSE 4 Network Security Professional exam, this scenario tests your understanding of how PBR differs from static routing and SD-WAN rules—a common trap is confusing PBR with policy-based NAT or route-based IPsec, but remember that PBR is purely about next-hop selection, not address translation. A useful memory tip: think of PBR as a “traffic bouncer” that checks each packet’s ID (destination and port) and sends it to a specific exit door, while the rest of the crowd flows through the main entrance.
⚠ Common exam trap
Test-takers frequently confuse policy-based routing with static routing or SD-WAN strategies, assuming that a more specific static route or a quality-based SD-WAN rule can achieve the same per-service interface selection, but only PBR provides the necessary layer-4 granularity to match both destination IP and port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policy-based routing (PBR) configured with a policy matching the destination and service
Policy-based routing (PBR) allows you to override the routing table based on match criteria such as source/destination IP, port, or protocol. In this scenario, you create a PBR policy that matches destination 203.0.113.50 and service TCP/443, then sets the next-hop to the WAN2 gateway. This ensures that only traffic to that specific web service exits via WAN2, while all other traffic follows the default route via WAN1.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Central NAT policy to force the traffic out of WAN2
Why it's wrong here
Central NAT only handles NAT, not routing decisions.
- ✗
Static route with a higher priority for WAN2 to 203.0.113.0/24
Why it's wrong here
A static route would affect all traffic to that subnet, but the requirement is for a specific service only.
- ✗
SD-WAN with a strategy of 'Best Quality'
Why it's wrong here
SD-WAN could achieve this, but the question asks for a feature; PBR is more direct.
- ✓
Policy-based routing (PBR) configured with a policy matching the destination and service
Why this is correct
PBR allows routing decisions based on firewall policy criteria.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate has multiple WAN interfaces (port1, port2) connected to different ISPs. The administrator wants traffic from the internal network to use port1 for general internet access but use port2 for traffic to a specific cloud service (203.0.113.0/24). Which feature should be used to achieve this?
medium- A.Create a VIP for the cloud service
- B.Configure static routes with different distances
- C.Use SD-WAN rules to load balance
- ✓ D.Use policy-based routing (PBR) to route traffic based on destination
Why D: Policy-based routing (PBR) allows you to override the default routing table based on criteria such as source/destination IP, protocol, or port. In this scenario, PBR can match traffic destined to 203.0.113.0/24 and force it out through port2, while all other internet traffic follows the default route via port1. This provides granular control without affecting the general routing behavior.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.