FortiGate Routing — Static, Policy Route, OSPF, BGP, and the Lookup Order in 11 Minutes

Why this matters — the airport visa queue

Picture the immigration counter at Bangalore airport. Five queues feed one officer. Diplomatic-status passengers go first — the officer waves them through without checking the regular queue. Then the standard queue (most of us). Walk-ins (last-minute boarding) come after. And finally, if you have no ticket at all, you join the any-flight-will-do default queue near the gate. That's exactly how a FortiGate picks where a packet goes.

Five lookup tiers, walked top-to-bottom: policy route → static → dynamic (OSPF/BGP) → SD-WAN rule → default route. First match wins, evaluation stops. Get this one sentence right and the next 10 minutes of the interview belong to you.

The four words an interviewer wants to hear

Behind the waterfall sit four concepts that decide ties: distance, priority, metric, and administrative selection. Distance picks which table wins when the same prefix exists in multiple sources. Priority picks the winner inside the static table when two routes share the same distance — most engineers don't know this exists and that's the L3-grade trap. Metric is the cost the protocol itself uses (OSPF cost, BGP MED). Administrative selection covers ISDB / SD-WAN tie-breakers.

Walking a packet — Karan's banking DC flow

Theory dies the moment you trace one real packet. Karan's branch user sits at 10.60.10.5; the core banking VLAN at DC2 lives on 10.70.20.0/24. Between them: FortiGate DC1 (10.60.0.1, OSPF area-0 ABR) and FortiGate DC2 (10.70.0.1). Here's the walk.

Real config — static + policy route on Karan's FG

Here's the exact CLI Karan keeps in his runbook for new DC builds.

config router static
    edit 1
        set dst 10.70.20.0 255.255.255.0
        set gateway 10.99.0.2
        set device "to-DC2-VPN"
        set distance 10
        set priority 0
        set comment "Primary path to DC2 core banking VLAN"
    next
    edit 2
        set dst 10.70.20.0 255.255.255.0
        set gateway 10.99.1.2
        set device "to-DC2-MPLS"
        set distance 10
        set priority 5
        set comment "Backup path — wins only if Route 1 goes down"
    next
    edit 99
        set dst 10.55.99.0 255.255.255.0
        set blackhole enable
        set comment "Anti-leak — drop test traffic during failover drills"
    next
end

config router policy
    edit 1
        set input-device "port5"
        set src "10.60.99.0/24"
        set dst "0.0.0.0/0"
        set protocol 0
        set output-device "wan2"
        set gateway 198.51.100.1
        set comment "Guest WiFi out the secondary ISP"
    next
end

Codes: K - kernel, C - connected, S - static, R - RIP, O - OSPF, IA - OSPF inter-area
       B - BGP, * - candidate default, ia - SR isis-A, V - BGP VPNv4

S*   0.0.0.0/0 [10/0] via 203.0.113.1, wan1
C    10.60.0.0/24 is directly connected, port5
S    10.55.99.0/24 [10/0] is a summary, Null0   ← blackhole route
S    10.70.20.0/24 [10/0] via 10.99.0.2, to-DC2-VPN
O IA 10.70.30.0/24 [110/30] via 10.99.0.2, to-DC2-VPN, 04:12:35
B    203.0.114.0/24 [20/0] via 203.0.113.50, wan1, 02:08:17

OSPF — the IGP every interviewer drills

OSPF is FortiGate's default workhorse for intra-AS routing — campus, DC-to-DC over IPsec, multi-site WAN. Three things separate someone who has READ about OSPF from someone who has run it: areas, LSA types, and the neighbor state machine. Get all three on the whiteboard in 90 seconds and you've cleared an L2 round.

FortiGate OSPF sits at distance 110 by default. Areas scope flooding — Area 0 (backbone) glues everything together; non-zero areas (1, 2, …) connect through ABRs. LSAs are the protocol's payload — flood them to identical topology databases on every router in the area, then SPF (Dijkstra) computes shortest paths.

The OSPF neighbor state machine — and the EXSTART trap

OSPF doesn't just "come up." It walks 7 states: Down → Init → 2-Way → ExStart → Exchange → Loading → Full. Most candidates stop at "Full = good." The L3-grade question is: where do tunnels get stuck, and why? Answer: EXSTART, almost always because of MTU mismatch.

Real config — OSPF area-0 between Karan's DC FortiGates

config router ospf
    set router-id 10.60.0.1
    config area
        edit 0.0.0.0
        next
    end
    config network
        edit 1
            set prefix 10.60.0.0 255.255.255.0
            set area 0.0.0.0
        next
        edit 2
            set prefix 10.99.0.0 255.255.255.0
            set area 0.0.0.0
        next
    end
    config interface
        edit "to-DC2-VPN"
            set hello-interval 10
            set dead-interval 40
            set mtu 1400
            set mtu-ignore enable
        next
    end
end

OSPF process 0, VRF 0:
Neighbor ID     Pri   State           Dead Time   Address         Interface
10.70.0.1         1   Full/  -        00:00:35    10.99.0.2       to-DC2-VPN

BGP — when SD-WAN underlay meets ISP peering

BGP is where Karan's design earns its money. The bank uses BGP to peer with two ISPs (AS 65001 + AS 65002) for internet redundancy, and again as the underlay for an SD-WAN overlay. Two flavours matter: eBGP for talking to the ISP, and iBGP for talking to another FortiGate in the same AS.

Real config — eBGP peering to the ISP

Karan peers FG DC1 (AS 65100) with ISP edge router (AS 65001) at 203.0.113.50. ISP demands MD5 password auth and rejects sessions with default TTL=1 if the FortiGate sits behind a small CPE — hence ebgp-multihop.

config router bgp
    set as 65100
    set router-id 10.60.0.1
    config neighbor
        edit "203.0.113.50"
            set remote-as 65001
            set password "banking-isp-md5"
            set ebgp-multihop enable
            set ebgp-multihop-ttl 5
            set route-map-in "rm-isp-in"
            set route-map-out "rm-isp-out"
        next
    end
    config network
        edit 1
            set prefix 203.0.114.0 255.255.255.0
        next
    end
end

config router route-map
    edit "rm-isp-in"
        config rule
            edit 10
                set match-ip-address "ACL-Default"
                set set-local-preference 200
            next
        end
    next
end

VRF 0 BGP router identifier 10.60.0.1, local AS number 65100
BGP table version is 47, main routing table version 47

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
203.0.113.50    4 65001    8421    7912       47    0    0 02:08:17        352

Total number of neighbors 1

Debug like an L3 — Karan's one-command checklist

Vikram, Karan's senior at the banking IT team, doesn't argue. He runs three commands in order. You should too.

# 1. Is the route in the active table?
get router info routing-table all | grep 10.70.20.0

# 2. Where did it come from? (OSPF? BGP? static?)
get router info routing-table database

# 3. Live route process — what's the OSPF/BGP daemon doing?
diagnose ip router command show

# 4. Drill into a specific protocol
get router info ospf neighbor
get router info ospf database
get router info bgp summary
get router info bgp network

One sweep tells you whether the route exists, which protocol won it, and whether the routing daemon is even healthy. No tcpdump. No guessing.