# FortiGate routing — policy first, then prove the FIB Source: https://ai.techclick.in/blog_fortinet_routing_ospf_bgp Markdown: https://ai.techclick.in/blog_fortinet_routing_ospf_bgp.md Publisher: Techclick Infosec Pvt Ltd FortiGate route look-up is policy route first, then the FIB. Static, OSPF and BGP compete inside the table by prefix, distance and priority. Prove the winner with get router info routing-table. Quick answer (say this out loud) FortiOS looks up a route twice per session (first packet each way). Official order: policy-based routes top-down; if one matches and can actually forward, that is the path. A miss goes to the FIB (kernel routing table). No FIB match is drop. Inside the routing table the most specific prefix wins; a tie is broken by lower administrative distance , then cost / priority , then ECMP. SD-WAN rules and Internet Service static routes live with policy routes on the Routing Monitor Policy view — they are not a fifth tier after OSPF. Prove the winner with get router info routing-table details <ip> ( Known via , best ) and all for the installed line. ## 1. Why the five-tier myth burns tickets Monday the SD-WAN rule “Office 365 → wan2” is green. Tuesday SaaS still egresses wan1. The operator runs get router info routing-table all , sees both defaults, and starts flipping OSPF costs. Wrong first tool. FortiOS already steered the flow on a forgotten policy route written six months ago. The routing table never got a vote. FortiOS 7.4 Routing concepts is blunt: look-up order is (1) policy-based routes, (2) the Forwarding Information Base / kernel routing table, (3) drop. The old interview chant “policy → static → dynamic → SD-WAN → default” is not that page. Default routes are just 0.0.0.0/0 rows inside the table. SD-WAN rules sit with policy routes. Hero · two exits, one look-up Notice: the box does not “prefer OSPF because it is dynamic.” It either matches a policy route or it consults the FIB. #### Policy route (PBR) Match incoming interface, source, destination, protocol, ports, ToS. Steer to an outgoing interface + gateway. Top-down. First usable match wins. #### Routing table / FIB Best prefixes from connected, static, OSPF, BGP. Longest match, then distance, then priority. all is installed; database is everything learned. ## 2. Mental model: PBR, then the FIB Memorize two rooms. Mixing them is why OSPF Full still “fails.” Room 1 — Policy routes. FortiOS starts at the top of config router policy . A match needs enough information to actually forward: outgoing interface and gateway. If either is missing, FortiOS searches the routing table for the best active route that completes that policy. If nothing in the table can complete it, that policy does not match, and FortiOS walks the next row. End of list with no match → Room 2. Room 2 — FIB. The routing daemon injects only the best of each prefix into get router info routing-table all . The kernel table ( get router info kernel ) is what forwards the packet. No match → drop. Journey · four stations First packet of a session writes the chosen route into the session table. A later routing change may or may not re-look-up — see preserve-session-route and snat-route-change in traps. Flow 1 · official look-up (FortiOS Routing concepts) FortiGate route look-up: policy-based routes, then FIB, else drop - Route look-up — policy first, FIB second, drop last New packet session not yet installed PBR match? 1 · Policy-based route forward on output + gateway STOP — session gets this path 2 · FIB / kernel longest prefix, then AD 3 · Drop no policy, no FIB match Policy family 1. Policy-based (PBR) 2. ISDB / Internet Service 3. SD-WAN rules Monitor → Policy view lists all three as active policy routes. Not after OSPF. PBR must be usable Need output intf + gateway, or a live RIB row that completes the policy. Read left → right, then down. A forgotten PBR is why “OSPF is Full” is not proof of the forwarding path. Re-read this section if Q1 on the quiz feels wrong. Say this out loud Policy route steers by 5-tuple before the routing table votes. The routing table only installs the best of each prefix. I prove both rooms: Policy view for PBR/SD-WAN/ISDB, then get router info routing-table details for the FIB winner. ## 3. Look-up order and RIB selection Open Dashboard → Network → Static & Dynamic Routing . That widget is the routing table. Toggle Static & Dynamic to Policy to see the policy-route family: policy routes you created, SD-WAN rules, and Internet Service static routes. That toggle is the interview screenshot. Inside the table, FortiOS 7.4 is also blunt: the most specific route always takes precedence. If two sources offer the same prefix, the lower administrative distance is injected. If distances also tie, cost and priority decide. If those tie, ECMP can install more than one next-hop. Decision · Path A vs Path B Path A is a usable policy-route match. Path B is a FIB look-up. There is no hidden “OSPF always after static” pass if a PBR already matched. Flow 2 · same prefix: distance, then priority RIB selection: longest prefix, then distance, then priority, then ECMP Same destination 0.0.0.0/0 — what gets installed? Two static defaults wan1 + wan2 both up Distance equal? Lower priority wins GUI 7.4 default priority 1 backup is distance-equal, priority-higher If distance differs: lower AD is injected Read the CLI line S* 0.0.0.0/0 [10/0] S = static · * = default [distance / metric] via 203.0.113.1, wan1 [1/0] trailing [prio / weight] O … [110/101] OSPF sample in the guide B … [20/0] eBGP sample in the guide DHCP default = dist 5 Read the brackets, not the row order in the GUI. A DHCP WAN with “Retrieve default gateway from server” injects a default at distance 5 and beats a static default at 10. Re-read this section for Q2. Hard words before the runbook Distance is the per-protocol trust rating (lower wins the injection). Static default 10; official sample shows OSPF [110/101] and eBGP [20/0] . Priority is the FortiOS static tie-breaker when distance is equal — lower number wins. FortiOS 7.4 GUI default is 1. Metric is the protocol cost (OSPF relative cost, BGP MED). Database is every learned route; > marks the selected one. Kernel is the FIB that actually forwards. ## 4. Static vs policy vs OSPF vs BGP Pick the tool by the question you are answering, not by “we always run OSPF.” Question Use Do not use One or two known next-hops to the internet or a VPN Static on Network → Static Routes . Distance 10, raise priority on the backup. A policy route that matches 0.0.0.0/0 from every LAN — it steals SD-WAN later. This source / service / incoming interface must leave a different WAN than the default Policy route ( Network → Policy Routes ). Or an SD-WAN rule if you already have zones + SLA. A more-specific static. Statics do not match source or port. Many internal prefixes, fast intra-AS failover, multi-vendor L3 OSPF ( Network → OSPF ). Area 0 backbone. Point-to-point on IPsec. eBGP as the campus IGP. Hold time 180 s is the wrong timer for DC failover. ISP underlay, AS boundary, policy on AS-path / local-pref eBGP ( Network → BGP ). Unique router-id. Multihop only if the peer is not adjacent. iBGP to the ISP. iBGP is same-AS; eBGP is the internet edge. VPN went down — do not leak that subnet to the WAN default Blackhole static. Interface = Blackhole. IPsec wizard creates these on purpose. Relying on the default 0.0.0.0/0 to “just fail closed.” It will not. SD-WAN is not a fifth routing protocol If the box already has SD-WAN members, a default static should usually point at the SD-WAN zone , not at wan1 alone. Application steering is an SD-WAN rule (policy-route family). A leftover config router policy row still beats that rule. Check Policy view before you debug SLA. ## 5. Runbook: static, policy route, OSPF, BGP Lab numbers are RFC 5737 / RFC 1918 training values: wan1 203.0.113.1 , wan2 198.51.100.1 , LAN 10.10.10.0/24 , guest 10.10.20.0/24 , OSPF fabric 10.0.0.0/24 on port3 , eBGP peer 203.0.113.50 AS 65002. Primary source for each block is named under the steps. ### Side A — Dual default statics Source: FortiOS Administration Guide — Routing concepts (“Adding or editing a static route”). #### Primary default Network → Static Routes → Create New . Destination subnet 0.0.0.0/0.0.0.0 , Interface wan1 , Gateway 203.0.113.1 , Administrative Distance 10. Expand Advanced Options and leave Priority at the GUI default (1 on FortiOS 7.4). - #### Backup default Same destination, Interface wan2 , Gateway 198.51.100.1 , Distance 10, Priority 10 (higher number = standby while both are up). Do not raise distance on the backup unless you want it to lose to OSPF/BGP as well. - #### DHCP WAN caution If wan1 is DHCP with Retrieve default gateway from server , FortiOS injects a default at distance 5 . That beats both statics. Disable retrieve, or raise that interface distance, before you trust the static pair. https://fw.lab.example/ng/network/static/edit Training mock · not live Network → Static Routes → Create New ### New Static Route IPv4 IPv6 Destination Subnet · 0.0.0.0/0.0.0.0 Interface wan1 Gateway Address 203.0.113.1 Administrative Distance 10 Priority (Advanced Options) 1 RFC 5737 training values. Named Address and Internet Service are valid Destination types. Blackhole is an Interface choice, not a gateway. Priority for a blackhole is CLI-only. Cancel OK Click next: OK → add the wan2 row with Priority 10 → open Dashboard → Network → Static & Dynamic Routing and confirm one S* default via wan1. Source: Routing concepts . CLI · dual static default (FortiOS Administration Guide shape) config router static edit 1 set dst 0.0.0.0 0.0.0.0 set gateway 203.0.113.1 set device "wan1" set distance 10 set priority 1 set comment "primary ISP" next edit 2 set dst 0.0.0.0 0.0.0.0 set gateway 198.51.100.1 set device "wan2" set distance 10 set priority 10 set comment "backup ISP" next end ### Side B — Policy route (guest HTTPS out wan2) Source: FortiOS Administration Guide — Policy routes . - #### Create the row Network → Policy Routes → Create New → Policy Route . Incoming interface lan (or the guest VLAN), Source 10.10.20.0/255.255.255.0 , Destination 0.0.0.0/0.0.0.0 , Protocol TCP, Destination ports 443–443, enable Outgoing interface wan2 , Gateway 198.51.100.1 . - #### Order is the preference A new policy is appended at the bottom. Drag it in the table, or config router policy / move 3 after 1 . First usable match wins. - #### Do not leave gateway or output empty unless you mean it If output or gateway is unset, FortiOS tries to complete the policy from the routing table. If the table cannot complete it, the policy does not match and evaluation continues. That is the silent “my PBR does nothing” ticket. https://fw.lab.example/ng/network/proute/edit Training mock · not live Network → Policy Routes → Create New → Policy Route ### New Policy Route Incoming interface lan Protocol TCP (6) Source Address 10.10.20.0/255.255.255.0 Destination Address 0.0.0.0/0.0.0.0 Destination ports 443 - 443 Outgoing interface wan2 Gateway address 198.51.100.1 Official sample uses FTP (TCP/21) out port4. Same fields. ToS / Bit Mask default 0x00. This is not a firewall policy — you still need an ACCEPT policy on the same path. Cancel OK Click next: OK → drag the row above any catch-all PBR → Dashboard → Network → Routing Monitor → Policy and confirm it is listed. Source: Policy routes . CLI · policy route (official field names) config router policy edit 1 set input-device "lan" set src "10.10.20.0/255.255.255.0" set dst "0.0.0.0/0.0.0.0" set protocol 6 set start-port 443 set end-port 443 set gateway 198.51.100.1 set output-device "wan2" set comments "guest HTTPS out backup ISP" next end ### Side C — OSPF area 0 + eBGP to the ISP Source: FortiOS Administration Guide — OSPF and BGP . - #### OSPF Network → OSPF . Set a unique Router ID ( 10.0.0.1 ). Areas: Area ID 0.0.0.0 , Type regular. Networks: prefix 10.0.0.0/255.255.255.0 in area 0. Interfaces: bind port3 , Network Type point-to-point on an IPsec overlay, Hello/Dead matching the peer. On an MTU-trimmed tunnel, enable mtu-ignore or set the same MTU on both sides — ExStart hang is the classic symptom. - #### eBGP Network → BGP . Local AS 65001 , Router ID 10.0.0.1 . Neighbors: IP 203.0.113.50 , remote AS 65002 . IPv4 Networks: advertise 10.10.0.0/255.255.0.0 only if you intend to originate it. If the peer is not on the same L2, enable ebgp-enforce-multihop (and a TTL that covers the hop count). - #### Do not double-originate Redistribute static into OSPF only with a route-map. Originating the same prefix as OSPF and BGP without a design is how you get distance surprises (eBGP 20 vs OSPF 110 vs static 10). CLI · OSPF then eBGP (Administration Guide objects) config router ospf set router-id 10.0.0.1 config area edit 0.0.0.0 next end config network edit 1 set prefix 10.0.0.0 255.255.255.0 set area 0.0.0.0 next end config ospf-interface edit "port3" set interface "port3" set network-type point-to-point set mtu-ignore enable next end end config router bgp set as 65001 set router-id 10.0.0.1 config neighbor edit "203.0.113.50" set remote-as 65002 set ebgp-enforce-multihop enable next end config network edit 1 set prefix 10.10.0.0 255.255.0.0 next end end ## 6. Prove it: get router info routing-table Route look-up happens on the first packet each way and is written into the session. You prove which room won with three CLI views plus the Policy monitor. Source: FortiOS Administration Guide — Routing concepts (route look-up, routing table, routing database) and Verifying routing table contents in NAT mode . Proof · the table, not the feeling Green SLA is not proof of the forwarding path. The installed line and the Policy view are. CLI · installed table (official sample shape) get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default Routing table for VRF=0 S* 0.0.0.0/0 [10/0] via 203.0.113.1, wan1, [1/0] S 0.0.0.0/0 [10/0] via 198.51.100.1, wan2, [10/0] C 10.10.10.0/24 is directly connected, lan O 10.20.0.0/16 [110/101] via 10.0.0.2, port3, 01:54:18 B 192.0.2.0/24 [20/0] via 203.0.113.50, wan1, 00:31:43 CLI · look-up one destination (official utility) get router info routing-table details 8.8.8.8 Routing table for VRF=0 Routing entry for 0.0.0.0/0 Known via "static", distance 10, metric 0, best * 203.0.113.1, via wan1 CLI · database vs kernel vs neighbors get router info routing-table database # > = selected route, * = FIB route. An O row without > lost to a better source. get router info kernel # actual FIB. tab=254 unicast. oif= is the outgoing interface. get router info ospf neighbor get router info bgp summary # OSPF Full / BGP Established is adjacency, not forwarding proof. diagnose firewall proute list # active policy-route family on the box you are sitting on. Green means For a destination IP: details prints Known via "static"|"ospf"|"bgp" and best , and all shows that prefix with the expected interface. For guest HTTPS: Policy monitor (or diagnose firewall proute list ) shows the PBR, and a new session after the change leaves wan2. OSPF Full or BGP Established alone is not enough. ## 7. Traps and pilot checklist Symptom Weak guess Actual first check Fix SD-WAN rule green; SaaS still uses wan1 SLA probe is lying A policy route matched first (Policy view / diagnose firewall proute list ) Move or delete the leftover PBR; SD-WAN is the same family, later in the list Two static defaults, “wrong” WAN is active Configuration order decides Distance tie → lower priority wins. Or DHCP default at distance 5 Read [dist/metric] and trailing [prio/weight] ; disable retrieve-default-gateway if it is stealing OSPF neighbor stuck ExStart / Exchange Area or hello timer Those usually die in Init / 2-Way. ExStart is DBD / MTU Align MTU or set mtu-ignore enable on the OSPF interface BGP State/PfxRcd = Active Need a route-map TCP/179 never established (wrong IP, firewall, or eBGP TTL=1 across a hop) set ebgp-enforce-multihop enable ; confirm SYN-ACK on 179 IPsec down; remote subnet now hits the internet Need a deny policy No blackhole; traffic followed 0.0.0.0/0 Network → Static Routes , Interface Blackhole , same prefix, distance worse than the tunnel route You changed the static; old TCP still uses wan1 FIB is stale forever Look-up is cached on the session. SNAT sessions keep the old egress while the old route is active preserve-session-route / snat-route-change ; or clear the test session and send a new first packet VDOM box: “empty routing table” Routing is global All get router info commands must run inside the VDOM config vdom / edit <name> first Weak vs strong interview answer Weak: “FortiGate checks policy, then static, then OSPF, then SD-WAN, then the default.” Strong: “Policy-based routes first — including ISDB and SD-WAN on the Policy monitor. Miss goes to the FIB: longest prefix, then distance, then priority. I prove it with get router info routing-table details and the Policy view, not with neighbor state.” Pilot checklist - Policy monitor empty of surprise rows (or every row is named and dated). - get router info routing-table all shows the expected S* / O / B line with the expected interface. - get router info routing-table details prints Known via + best on that same next-hop. - database shows a > on the winner; losers have no > . - OSPF Full or BGP Established only after the FIB line is right. - New session after the change (do not trust an old SNAT session). - If VDOMs: proof taken inside the traffic VDOM. ## Knowledge check Six judgment items. Map each miss back to the section named in the reason. Q1 FortiOS 7.4 Routing concepts states the route look-up order. What is that order? Static, then OSPF/BGP, then SD-WAN, then policy route, then default Policy-based routes; then the FIB / kernel table; else drop Longest-prefix in the routing table first; policy routes only if the FIB misses SD-WAN rules always win because they have health checks Correct: b . Official look-up is PBR → FIB → drop. SD-WAN and ISDB sit with policy routes, not after OSPF. Re-read Mental model and Look-up order . Q2 Two static defaults: wan1 distance 10 priority 1, wan2 distance 10 priority 10. Both interfaces are up. Which is active? wan1 — same distance, lower priority number wins wan2 — higher priority always wins Neither; FortiOS ECMP-hashes every default regardless of priority The route that was created last Correct: a . Equal distance, lower priority wins. ECMP needs distance and priority equal. Re-read Look-up order and RIB selection . Q3 An SD-WAN rule steers Microsoft 365 to wan2. The SLA is green. get router info routing-table all shows both defaults. Traffic still leaves wan1. What do you run next? Raise the OSPF cost on wan1 Disable BGP — eBGP distance 20 is stealing the default Check the Policy routing monitor / leftover config router policy — PBR already matched Clear ARP; the next-hop MAC is stale Correct: c . SD-WAN is in the policy-route family and loses to an earlier usable PBR. The FIB looking healthy does not disprove that. Re-read Why the five-tier myth burns tickets and Traps . Q4 Two FortiGates form OSPF over a new IPsec tunnel. get router info ospf neighbor sits in ExStart and never reaches Full. Most likely cause? Duplicate router-id — adjacency would still reach Full Area mismatch — that usually dies in Init, not ExStart Hello / Dead mismatch — neighbor is never seen MTU mismatch on DBD exchange — align MTU or enable mtu-ignore Correct: d . ExStart is the DBD stage. Area / hello / router-id problems stop earlier. Re-read Side C and Traps . Q5 get router info bgp summary shows the ISP peer in Active. Tcpdump on wan1 sees outbound TCP/179 SYNs, no SYN-ACK. The peer is three hops away. First fix? Lower keepalive to 10 s — Active means the hold timer is too long Enable ebgp-enforce-multihop (eBGP TTL is 1 by default) and confirm 179 is permitted Change the neighbor to iBGP so TTL is no longer an issue Redistribute OSPF into BGP — Active means zero prefixes Correct: b . Active is TCP not established. eBGP to a non-adjacent peer needs multihop. Re-read Side C and Traps . Q6 You must prove which next-hop FortiOS will use for 8.8.8.8 from the FIB. Official look-up utility? get router info ospf neighbor — if Full, OSPF is the path diagnose sys session list only — the FIB is never consulted get router info routing-table details 8.8.8.8 and confirm Known via + best execute ping 8.8.8.8 — a reply proves the static default Correct: c . The Administration Guide documents get router info routing-table details <ip> as the CLI look-up. Neighbor state and ping are not the FIB winner. Re-read Prove it . Check answers Reset ## Sources - FortiOS 7.4 Administration Guide — Routing concepts (default route, static GUI fields, table vs database vs kernel, official look-up order, get router info routing-table details , blackhole, session re-look-up). - FortiOS 7.4 Administration Guide — Policy routes ( Network → Policy Routes , match/complete rules, official CLI, move ). - FortiOS 7.4 Administration Guide — Verifying routing table contents in NAT mode ( get router info routing-table all sample codes). - FortiOS 7.4 Administration Guide — OSPF ( Network → OSPF fields). - FortiOS 7.4 Administration Guide — BGP ( Network → BGP fields). - FortiOS 8.0 Administration Guide — Policy routes (policy-route family precedence: policy-based, ISDB, SD-WAN; miss → routing table). Related: FortiGate policy lookup + NAT · FortiGate SD-WAN SLA · FortiGate IPsec / SSL-VPN · FortiGate interview · Troubleshooting command center --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt