Policy-Based Routing for Selective Internet Traffic on FortiGate
An organization has a FortiGate with two internet connections (WAN1 and WAN2). They want traffic to a specific web service (203.0.113.50 port 443) to always exit via WAN2. All other internet traffic should use WAN1. Which feature should be used to achieve this?
Quick Answer
The answer is policy-based routing (PBR), which should be configured with a policy matching the destination IP 203.0.113.50 and service TCP/443 to force that traffic out WAN2. PBR is the correct choice because it allows you to selectively override the default routing table based on criteria like source, destination, or service, ensuring that only specific traffic follows a different path while all other traffic continues to use the regular route via WAN1. On the Fortinet NSE 4 Network Security Professional exam, this scenario tests your understanding of how PBR differs from static routing and SD-WAN rules—a common trap is confusing PBR with policy-based NAT or route-based IPsec, but remember that PBR is purely about next-hop selection, not address translation. A useful memory tip: think of PBR as a “traffic bouncer” that checks each packet’s ID (destination and port) and sends it to a specific exit door, while the rest of the crowd flows through the main entrance.
⚠ Common exam trap
Test-takers frequently confuse policy-based routing with static routing or SD-WAN strategies, assuming that a more specific static route or a quality-based SD-WAN rule can achieve the same per-service interface selection, but only PBR provides the necessary layer-4 granularity to match both destination IP and port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policy-based routing (PBR) configured with a policy matching the destination and service
Policy-based routing (PBR) allows you to override the routing table based on match criteria such as source/destination IP, port, or protocol. In this scenario, you create a PBR policy that matches destination 203.0.113.50 and service TCP/443, then sets the next-hop to the WAN2 gateway. This ensures that only traffic to that specific web service exits via WAN2, while all other traffic follows the default route via WAN1.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Central NAT policy to force the traffic out of WAN2
Why it's wrong here
Central NAT controls source and destination address translation, not egress interface selection; it cannot force traffic out of WAN2. It is tempting because NAT policies are configured per outgoing interface, and would be correct if the requirement were to apply consistent translation rules across multiple VDOMs.
- ✗
Static route with a higher priority for WAN2 to 203.0.113.0/24
Why it's wrong here
A static route to 203.0.113.0/24 cannot match on destination port, so it would divert all traffic to that subnet via WAN2, not just port 443. It is tempting because static routes do steer specific destinations, and would be correct if only the destination subnet needed redirecting regardless of port.
- ✗
SD-WAN with a strategy of 'Best Quality'
Why it's wrong here
Best Quality selects the link by measured latency, jitter and packet loss, so WAN2 is not guaranteed for 203.0.113.50:443 and WAN1 may win. It is tempting because SD-WAN steers traffic across multiple links, and would be correct if the goal were dynamic per-link quality selection rather than a fixed exit.
- ✓
Policy-based routing (PBR) configured with a policy matching the destination and service
Why this is correct
PBR overrides the routing table lookup for matching traffic, letting you steer sessions to 203.0.113.50:443 out WAN2 while the default route sends everything else via WAN1. A plain static route cannot selectively match destination plus service, so PBR satisfies the per-service egress constraint.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate has multiple WAN interfaces (port1, port2) connected to different ISPs. The administrator wants traffic from the internal network to use port1 for general internet access but use port2 for traffic to a specific cloud service (203.0.113.0/24). Which feature should be used to achieve this?
medium- A.Create a VIP for the cloud service
- B.Configure static routes with different distances
- C.Use SD-WAN rules to load balance
- ✓ D.Use policy-based routing (PBR) to route traffic based on destination
Why D: Policy-based routing (PBR) allows you to override the default routing table based on criteria such as source/destination IP, protocol, or port. In this scenario, PBR can match traffic destined to 203.0.113.0/24 and force it out through port2, while all other internet traffic follows the default route via port1. This provides granular control without affecting the general routing behavior.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.