An administrator configures a policy route that forces all traffic from the back-office billing subnet out through a specific WAN interface and gateway, but that WAN interface is currently down. What happens to traffic matching the policy route while the interface is down?
Select an answer to reveal the explanation.
Short Explanation
Think of a policy route as a detour sign that only counts if the detour road is actually open. When that WAN interface is down, the FortiGate can't find a usable route to the gateway, so the policy route simply doesn't match and your billing traffic falls back to the normal routing table.
Full Explanation
FortiOS evaluates policy routes from the top of the list, but a match requires more than the source, destination and protocol criteria. The policy route must also resolve to a usable path: when both the outgoing interface and gateway are specified, the FortiGate still has to find a route in the routing table proving the gateway is reachable over that interface. When the WAN interface is down, its connected route disappears, so that check fails and the policy route does not match the packet. The FortiGate then continues down the policy route list and, if nothing else matches, performs a normal routing-table lookup, which is why the billing traffic quietly follows the regular route. The claim that matching traffic simply fails assumes a policy route pins traffic even to a dead path, which is not how FortiOS evaluates them. FortiOS also never rewrites a configured policy route to point at a different interface; it just skips it while it cannot be satisfied. Firewall policies are a separate mechanism and are not disabled by a routing failure. On the exam, remember that an unusable policy route is skipped rather than enforced. To verify, bring the interface down in a lab, run diagnose firewall proute list, and trace a billing flow with diagnose debug flow to watch it use the routing-table path.