Troubleshoot Policy Route Not Matching Traffic
A FortiGate administrator configures policy-based routing (PBR) to direct traffic from subnet 192.168.1.0/24 to the internet via ISP1. However, traffic from that subnet is still using the default route via ISP2. What is the most likely cause?
Quick Answer
The answer is a mismatch in the PBR rule’s source address configuration. Policy-based routing on FortiGate overrides the default route only when traffic matches every defined criterion, including the source IP and subnet mask; if the rule specifies 192.168.1.0/24 but the actual traffic originates from a slightly different subnet or a typo exists in the mask, the traffic does not match and falls through to the routing table, defaulting to ISP2. On the Fortinet NSE 4 exam, this scenario tests your understanding that PBR is evaluated before the routing table but is strictly conditional—a common trap is assuming PBR applies globally, when in fact it requires exact source, destination, and interface matches. Remember the memory tip: “PBR is picky—if the source doesn’t match, the route dispatches.”
⚠ Common exam trap
Candidates often confuse PBR with static routing and assume the default route's administrative distance or priority can override PBR, but PBR is evaluated before the routing table and is not subject to route metrics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The PBR rule's source address does not match the traffic correctly.
Policy-based routing (PBR) on FortiGate overrides the routing table only when the traffic matches all configured criteria, including the source address. If the source address in the PBR rule does not match 192.168.1.0/24 exactly (e.g., a typo, wrong subnet mask, or missing entry), the traffic falls through to the default route via ISP2. This is the most likely cause because PBR rules are evaluated before the routing table, but only for matching traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is troubleshooting why traffic from a specific source IP is not being matched by a policy route. Which THREE steps should the administrator take to diagnose the issue?
medium- A.Disable all firewall policies to test routing.
- B.Change the administrative distance of the default route to 0.
- ✓ C.Verify the source address object in the policy route matches the traffic's source IP.
- ✓ D.Check the policy route list order and ensure the matching condition is above the default route.
- ✓ E.Use the 'diagnose debug flow' command to trace packet flow.
Why C: The most fundamental step in troubleshooting a policy route mismatch is to verify that the source address object defined in the policy route exactly matches the source IP of the traffic. If the object is misconfigured (e.g., wrong subnet mask, incorrect IP range, or a typo), the traffic will never hit the policy route, regardless of other settings.
Variation 2. An administrator notices that traffic to a particular subnet is being load-balanced across two WAN links, but they want all traffic to that subnet to use a single link. Which feature should be configured?
medium- ✓ A.Policy routing
- B.ECMP routing
- C.Static route with higher distance
- D.Route summarization
Why A: Policy routing (also called PBR) allows you to override the routing table based on criteria such as source/destination IP, protocol, or port. By configuring a policy route that matches traffic to the specific subnet and sets the output interface to a single WAN link, you can force all that traffic to use one link instead of being load-balanced.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.