DO NOT REPRINT

© FORTINET
Lab 3: Routing

In this lab, you will configure the router settings and test scenarios to learn how FortiGate makes routing
decisions.

Objectives
 Route traffic based on the destination IP address, as well as other criteria
 Balance traffic among multiple paths
 Implement route failover
 Diagnose a routing problem

Time to Complete
Estimated: 50 minutes

Prerequisites
Before beginning this lab, you must restore a configuration file to Local-FortiGate.

To restore the Local-FortiGate configuration file

1. Connect to the Local-FortiGate GUI, and then log in with the username admin and password password.
2. In the upper-right corner of the screen, click admin, and then click Configuration > Revisions.

3. Click the + sign to expand the list.

4. Select the configuration with the comment initial, and then click Revert.

FortiGate Lab Guide

Fortinet Technologies Inc.
DO LNabO
3: RT
outiR
ng EPRINT VM Usernames and Passwords

© FORTINET

5. Click OK to reboot.

VM Usernames and Passwords

VM Username Password

Local-Client Administrator password

Remote-Client Administrator password

Local-FortiGate admin password

Remote-FortiGate admin password

FortiGate Lab Guide

Fortinet Technologies Inc
DO VNM O
UseT ResEanP
rnam d PR
assIwN
ordT
s Lab 3: Routing

© FORTINET
VM Username Password

ISFW admin password

FortiAnalyzer admin password

FortiGate Lab Guide

Fortinet Technologies Inc.
DO NOT REPRINT
© FORTINET
Exercise 1: Configuring Route Failover

In the lab network, Local-FortiGate has two interfaces connected to the internet: port1 and port2. In this exercise,
you will configure the port1 connection as the primary internet link, and the port2 connection as the backup
internet link. Local-FortiGate should use the port2 connection only if the port1 connection is down. To achieve this
objective, you will configure two default routes with different administrative distances, as well as two link health
monitors.

Verify the Routing Configuration

You will verify the existing routing configuration on Local-FortiGate.

Take the Expert Challenge!

On the Local-FortiGate GUI (admin/password), complete the following:

View the existing static route configuration on Local-FortiGate.

Enable the Distance and Priority columns on the static route configuration page.
Make note of the Distance and Priority values of the existing default route.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Configure a Second Default Route on page 18.

To verify the routing configuration

1. Connect to the Local-FortiGate GUI, and then log in with the username admin and password password.
2. Click Network > Static Routes.
3. Verify the existing default route for port1.

4. Right-click any of the columns to open the context-sensitive menu.

5. In the Select Columns section, select Distance and Priority, and then click Apply.

FortiGate Lab Guide

Fortinet Technologies Inc
DO CNonO
figuT
re aR
SecE
onP
d DR
efaI
uN Tute
lt Ro Exercise 1: Configuring Route Failover

© FORTINET

The Distance and Priority columns appear in the GUI.

Note that, by default, static routes have a Distance value of 10, and a Priority value of 0.

Configure a Second Default Route

You will create a second default route using the port2 interface. To make sure this second default route remains
inactive, you will assign it a higher distance.

Take the Expert Challenge!

On the Local-FortiGate GUI, configure a second default route using port2.

Assign it a Distance of 20, and a Priority of 5.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Configure the Firewall Policies on page 19.

To configure a second default route

1. Continuing on the Local-FortiGate GUI, click Network > Static Routes.
2. Click Create New.

FortiGate Lab Guide

Fortinet Technologies Inc.
DO ENxeO
rcisT RonE
e 1: C PrinR
figu g RIoN
uteT
Failover Configure the Firewall Policies

© FORTINET
3. Configure the following settings:

Field Value

Gateway Address [Link]

Interface port2

Administrative Distance 20

4. Click the + sign to expand the Advanced Options section.

5. In the Priority field, type 5.

6. Click OK.
A second default route is added.

Configure the Firewall Policies

You will modify the existing Full_Access firewall policy to log all sessions. You will also create a second firewall
policy to allow traffic through the secondary interface.

FortiGate Lab Guide

Fortinet Technologies Inc
DO CNonO
figuT
re thR
e FE PallR
irew PoI
licN
iesT Exercise 1: Configuring Route Failover

© FORTINET
Take the Expert Challenge!

Continuing on the Local-FortiGate GUI, enable logging for all sessions in the existing Full_Access
firewall policy.
Create a second firewall policy named Backup_Access.
Configure the Backup_Access policy to allow traffic from port3 to port2 with NAT enabled.
Enable logging on the Backup_Access policy for all sessions.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see View the Routing Table on page 21

To configure the firewall policies

1. Continuing on the Local-FortiGate GUI, click Policy & Objects > Firewall Policy.
2. Double-click the existing Full_Access policy to edit it.
3. Enable logging for All Sessions.

All Sessions logging ensures that all traffic is logged and not only sessions inspected
by security profiles. This will assist you in verifying traffic routing using the Forward
Traffic logs.

4. Click OK.
5. Click Create New.
6. Configure a second firewall policy with the following settings:

Field Value

Name Backup_Access

FortiGate Lab Guide

Fortinet Technologies Inc
DO ENxeO
rcisT RonE
e 1: C PrinR
figu g RIoN
uteT
Failover View the Routing Table

© FORTINET
Field Value

Incoming Interface port3

Outgoing Interface port2

Source LOCAL_SUBNET

Destination all

Schedule always

Service ALL

Action Accept

NAT Enabled

Log Allowed Traffic All Sessions

7. Click OK.

View the Routing Table

The Local-FortiGate configuration now has two default routes with different distances. You will view the routing
table to see which one is active.

To view the routing table

1. On the Local-FortiGate CLI, log in with the username admin and password password.
2. Enter the following command to confirm the list of active routes in the routing table:
get router info routing-table all

Note that the second default route is not listed.

3. Enter the following command to list active, standby, and inactive routes:
get router info routing-table database

4. Confirm that the second default route is listed as inactive.

FortiGate Lab Guide

Fortinet Technologies Inc
DO CNonO
figuT
re LiR EeaPlthR
nk H MoInN
itorsT Exercise 1: Configuring Route Failover

© FORTINET

Stop and think!

Why is the port2 default route the standby route?

The port2 default route has a higher administrative distance than the port1 default route. When two or
more routes to the same destination have different distances, the higher distance route is not installed in
the routing table, but you can still see it in the routing table database. Routes marked as inactive are
marked inactive when the corresponding interface is down.

5. Leave the Local-FortiGate CLI session open.

Test the Route Failover

First, you will access various websites and use the Forward Traffic logs to verify that the port1 route is being
used. Next, you will force a failover by reconfiguring the port1 link health monitor to ping an invalid IP address. You
will then generate some more traffic, and use the Forward Traffic logs to verify that the port2 route is being used.

To confirm the port1 route is the primary route

1. Return to the browser tab where you are logged in to the Local-FortiGate GUI, and then click Log & Report >
Forward Traffic.
2. Right-click any of the columns to open the context-sensitive menu.
3. In the Select Columns section, select Destination Interface.

FortiGate Lab Guide

Fortinet Technologies Inc
DO ENxeO
rcisT RonE
e 1: C PrinR
figu g RIoN
uteT
Failover Test the Route Failover

© FORTINET

4. Scroll down in the context-sensitive menu, and then click Apply.

The Destination Interface column is displayed.

5. Open a few new tabs in the browser, and visit a few websites, such as:
 [Link]
 [Link]
 [Link]

FortiGate Lab Guide

Fortinet Technologies Inc
DO TNesO
t theT Rte E
Rou FailP r INT
oveR Exercise 1: Configuring Route Failover

© FORTINET
6. Return to the browser tab where you are logged in to the Local-FortiGate GUI, and click Log & Report > Forward
Traffic.
7. Click the refresh icon.

8. Locate the relevant log entries for the three websites you accessed, and verify that their Destination Interface
indicates port1.

This verifies that the port1 route is currently active and in use.

To force the failover

1. Continuing on the Local-FortiGate GUI, click Network > Interfaces.
2. Double-click the port1 interface to edit it.
3. In the Miscellaneous section, click Disabled as the status.
4. Click OK.
The port1 internet connection is now down, and FortiGate removes the corresponding route from the routing
table.

To verify the route change

1. Return to the browser tab where you are logged in to the Local-FortiGate GUI, and click Log & Report > Events >
System Events.
Verify that the Local-FortiGate detected the link monitor failure and removed the corresponding port1 route.

FortiGate Lab Guide

Fortinet Technologies Inc
DO ENxeO
rcisT RonE
e 1: C PrinR
figu g RIoN
uteT
Failover Restore the Routing Table

© FORTINET
2. Click Dashboard > Network, and then click Routing to expand it to fullscreen.
3. Verify that the port2 route is active in the routing table.

To verify traffic logs

1. On the Local-Client VM, open a few new tabs in the browser, and visit a few websites, such as:
 [Link]
 [Link]
 [Link]
2. Return to the browser tab where you are logged in to the Local-FortiGate GUI, and click Log & Report > Forward
Traffic.
3. Locate the relevant log entries for the three websites you accessed, and verify that their Destination Interface
indicates port2.

This verifies that the Local-FortiGate is using the port2 default route.

Restore the Routing Table

Before you begin the next exercise, you will restore the port1 interface settings and bring it up, which will restore
the port1 default route as the best route in the routing table.

To restore the port1 health monitor configuration

1. Continuing on the Local-FortiGate GUI, click Network > Interfaces.
2. Double-click the port1 interface to edit it.
3. In the Miscellaneous section, click Enabled as the status.
4. Click OK.

FortiGate Lab Guide

Fortinet Technologies Inc
DO RNesO
toreT
theR EtinP
Rou g TR INT
able Exercise 1: Configuring Route Failover

© FORTINET
To verify the routing table
1. Return to the browser tab where you are logged in to the Local-FortiGate GUI, click Dashboard > Network, and
then click Routing to expand it to fullscreen.
2. Verify that the port2 route is removed, and the port1 route is active.

3. Close the browser.

FortiGate Lab Guide

Fortinet Technologies Inc
DO NOT REPRINT
© FORTINET
Exercise 2: Configuring Equal Cost Multipath and Policy
Routing

In this exercise, you will configure equal cost multipath (ECMP) routing on Local-FortiGate to balance the internet
traffic between port1 and port2. After that, you will configure a policy route to route HTTPS traffic through port1
only.

Configure Administrative Distance

To establish ECMP, first you will configure multiple static routes with the same administrative distance.

Take the Expert Challenge!

On the Local-FortiGate GUI (admin/password), complete the following:

Change the port2 static route Administrative Distance to 10.

Verify that both port1 and port2 default routes are active in the routing table.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Change the ECMP Load Balancing Method on page 28.

To configure administrative distance

1. Connect to the Local-FortiGate GUI, and then log in with the username admin and password password.
2. Click Network > Static Routes.
3. Double-click the port2 static route to edit it.
4. Change the Administrative Distance to 10.

5. Click OK.

FortiGate Lab Guide

Fortinet Technologies Inc
DO CNhaO
ngeT
theR
ECE
MPP
LoR IN
ad B alanT
cing Method Exercise 2: Configuring Equal Cost Multipath and Policy Routing

© FORTINET
To verify the routing table
1. Continuing on the Local-FortiGate GUI, click Dashboard > Network, and then click Routing to expand it to
fullscreen.
2. Verify that both default routes are now active.

Change the ECMP Load Balancing Method

By default, the ECMP load balancing method is based on source IP address. This works well when there are
multiple clients generating traffic. In the lab network, because you have only one client (Local-Client), the source
IP address method will not balance any traffic to the second route. Only one route will always be used. For this
reason, you will change the load balancing method to use both source and destination IP addresses. Using this
method, as long as the traffic goes to multiple destination IP addresses, FortiGate will balance the traffic across
both routes.

To modify the ECMP load balancing method

1. On the Local-FortiGate CLI, log in with the username admin and password password.
2. Enter the following commands to change the ECMP load-balancing method:
config system settings
set v4-ecmp-mode source-dest-ip-based
end

3. Leave the Local-FortiGate CLI session open.

Verify Traffic Routing

You will generate some HTTP traffic and verify traffic routing using the Forward Traffic logs.

FortiGate Lab Guide

Fortinet Technologies Inc
DO ENxeO
rcisT RonE
e 2: C PrinR
figu g EIqN
ual T
Cost Multipath and Policy Routing Configure Priority

© FORTINET
Take the Expert Challenge!

On the Local-Client VM, open a few new browser tabs, and then generate some HTTP traffic.
Verify the traffic routing on Local-FortiGate, using the Forward Traffic logs.
Identify why all the outgoing packets are still being routed through port1.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Configure Priority on page 29.

To verify traffic routing

1. On the Local-Client VM, open new tabs in the browser, and visit a few websites, such as:
 [Link]
 [Link]
 [Link]
2. Return to the browser tab where you are logged in to the Local-FortiGate GUI, and click Log & Report > Forward
Traffic.
3. Identify the Destination Interface in the relevant log entries for the websites you accessed.

Why are all the outgoing packets still being routed through port1?

Stop and think!

The port2 route is not being used because it was configured with a higher priority value than the port1 route.
When two routes to the same destination have the same administrative distance, both remain active.
However, if the priorities are different, the route with the lowest priority value is used. To achieve ECMP
with static routes, the distance and priority values must be the same for both routes.

Configure Priority

You will change the priority value for the port2 route to match the port1 route.

FortiGate Lab Guide

Fortinet Technologies Inc
DO VNeriO
fy ET REPRINT
CMP Exercise 2: Configuring Equal Cost Multipath and Policy Routing

© FORTINET
Take the Expert Challenge!
On the Local-FortiGate GUI, modify the static routing configuration so both default routes are eligible for
ECMP.

If you require assistance, or to verify your work, use the step-by-step instructions that follow.

To configure priority
1. Continuing on the Local-FortiGate GUI, click Network > Static Routes.
2. Double-click the port2 default route to edit it.
3. Click the + sign to expand the Advanced Options section.
4. Change the Priority value to 0.
5. Click OK.

Verify ECMP

Now that both port1 and port2 routes share the same distance and priority values, they are eligible for ECMP.
First, you will verify the routing table, and then you will verify traffic routing using the Forward Traffic logs.

To verify the routing table

1. Return to the Local-FortiGate CLI session, and enter the following command on Local-FortiGate:
get router info routing-table database

2. Verify that both default routes are currently active.

To configure the CLI sniffer

1. Continuing on the Local-FortiGate CLI session, enter the following command:

FortiGate Lab Guide

Fortinet Technologies Inc
DO ENxeO
rcisT RonE
e 2: C PrinR
figu g EIqN
ual T
Cost Multipath and Policy Routing Configure a Policy Route for HTTPS Traffic

© FORTINET
diagnose sniffer packet any ' not host [Link] and not host [Link] and tcp
[13]&2==2 and port 80' 4

The filter 'tcp[13]&2==2' matches packets with the SYN flag on, so the output will
show all SYN packets for port 80 (HTTP).

2. Leave the Local-FortiGate CLI window open in the background.

To verify ECMP routing

1. On the Local-Client VM, open new tabs in the browser, and visit a few websites, such as:
 [Link]
 [Link]
 [Link]
2. Return to the Local-FortiGate CLI session, and press Ctrl+C to stop the sniffer.
3. Analyze the sniffer output.

The SYN packets are egressing both port1 and port2. This verifies that Local-FortiGate is now load
balancing all internet traffic across both routes.

4. Leave the Local-FortiGate CLI session open.

Configure a Policy Route for HTTPS Traffic

You will force all HTTPS traffic to egress through port1 using a policy route. All other traffic should remain
unaffected and balanced between port1 and port2. To implement this, you will configure a policy route.

To configure a policy route for HTTPS traffic

1. Return to the browser tab where you are logged into the Local-FortiGate GUI, and click Network > Policy Routes.
2. Click Create New.
3. Configure the following settings:

FortiGate Lab Guide

Fortinet Technologies Inc
DO CNonO
figuT
re aR
PolE
icy P
RoR
ute IfoN
r HT
TTPS Trafic Exercise 2: Configuring Equal Cost Multipath and Policy Routing

© FORTINET
Field Value

Incoming interface port3

Source Address > IP/Netmask [Link]/24

Destination Address > IP/Netmask [Link]/0

Protocol TCP

Source ports From 1 to 65535

Destination ports From 443 to 443

Action Forward Traffic

Outgoing interface Enabled and port1

Gateway address [Link]

The policy route should look like the following example:

4. Click OK.

FortiGate Lab Guide

Fortinet Technologies Inc
DO ENxeO
rcisT RonE
e 2: C PrinR
figu g EIqN
ual T
Cost Multipath and Policy Routing Verify the Policy Route

© FORTINET
Verify the Policy Route

First, you will verify the routing table, and then verify policy routing by generating HTTPS traffic and viewing the
CLI sniffer output.

To verify the policy route table

1. Continuing on the Local-FortiGate GUI, click Dashboard > Network, and then click Routing to expand it to
fullscreen.
2. In the upper-right corner, click Static & Dynamic, and then select Policy in the drop-down list.

To verify policy routing for HTTPS traffic

1. Return to the open Local-FortiGate CLI session, and enter the following command on Local-FortiGate:
diagnose sniffer packet any ' not host [Link] and not host [Link] and tcp
[13]&2==2 and port 443' 4

As before, this sniffer filter matches packets with the SYN flag on, but this time for port
443 (HTTPS).

Leave the Local-FortiGate CLI window open in the background.

2. On the Local-Client VM, open new tabs in the browser, and then visit a few HTTPS websites, such as:
 [Link]
 [Link]
3. Return to the Local-FortiGate CLI session, and then press Ctrl+C to stop the sniffer.
4. Analyze the sniffer output.

FortiGate Lab Guide

Fortinet Technologies Inc
DO VNeriO
fy thT
e PoR
licyEPuteRINT
Ro Exercise 2: Configuring Equal Cost Multipath and Policy Routing

© FORTINET

The SYN packets are egressing port1 only. This verifies that Local-FortiGate is applying the policy route for
HTTPS traffic.

To verify non-HTTPS traffic routing

1. Continuing on your Local-FortiGate CLI session, enter the following command:
diagnose sniffer packet any ' not host [Link] and not host [Link] and tcp
[13]&2==2 and port 80' 4

2. On the Local-Client VM, open new tabs in the browser, and then visit a few HTTP websites, such as:
 [Link]
 [Link]
 [Link]
3. Return to the open Local-FortiGate CLI session, and press Ctrl+C to stop the sniffer.
4. Analyze the sniffer output.

HTTP (port 80) traffic remains unaffected by the policy route, and is still load balanced across both port1 and
port2 routes.

Stop and think!

The Local-FortiGate configuration still has the two link health monitors for port1 and port2. Do they also
enable routing failover for ECMP scenarios?

Yes. If Local-FortiGate detects a problem in any of the routes, the link monitor removes the corresponding
route, and all internet traffic is routed through the remaining route.

5. Close the Local-FortiGate CLI session and browser.

FortiGate Lab Guide

Fortinet Technologies Inc