Routing

FortiGate Administrator
Routing

FortiOS 7.6
Last Modified: 16 January 2025

In this lesson, you will learn about the routing capabilities and features available on FortiGate.

FortiGate 7.6 Administrator Study Guide 82

 Routing

Lesson Overview

Routing on FortiGate

ECMP Routing
© Fortinet Inc. All Rights Reserved. 2

In this lesson, you will learn about the topics shown on this slide.

FortiGate 7.6 Administrator Study Guide 83

 Routing

Routing on FortiGate

Objectives
• Configure static routing
• Interpret the routing table on FortiGate

© Fortinet Inc. All Rights Reserved. 3

After completing this section, you should be able to achieve the objectives shown on this slide.

By demonstrating competence in routing on FortiGate, you should be able to implement static routing and
understand the routing table.

FortiGate 7.6 Administrator Study Guide 84

 Routing

What Is IP Routing?
• FortiGate acts as an IP router in network address translation (NAT) mode
• Forwards packets between IP networks
• Supports IPv4 and IPv6 routing
• IP routing:
• Performed for firewall traffic and local-out traffic
• Determines next hop (outgoing interface and gateway) for packet destination address
• Next hop can be the destination router or another router along the path

© Fortinet Inc. All Rights Reserved. 4

When FortiGate operates in NAT mode—the default operation mode—FortiGate behaves as an IP router. An
IP router is a device that forwards packets between IP networks. For that, a router performs IP routing, which
is the process of determining the next hop to forward a packet to based on the packet destination IP address.
FortiGate supports both IPv4 and IPv6 routing.

FortiGate performs routing for both firewall traffic (also known as user traffic) and local-out traffic. Firewall
traffic is the traffic that travels through FortiGate. Local-out traffic is the traffic generated by FortiGate, usually
for management purposes. For example, when you ping a device from FortiGate, that’s local-out traffic. When
FortiGate connects to FortiGuard to download the latest definitions, that’s also local-out traffic.

FortiGate 7.6 Administrator Study Guide 85

 Routing

What Is IP Routing? (Contd)

• Routing table:
• Contains routes with next-hop information for a destination
• Entries are checked during route lookup (best route selection)
• Best route: most specific route to the destination
• Duplicate routes: multiple routes to the same destination
• Route attributes are used as tiebreakers for best route selection

• Routing precedes most security actions

• Configure your security policies based on routing settings, not the opposite

© Fortinet Inc. All Rights Reserved. 5

Routers maintain a routing table. A routing table contains a series of entries, also known as routes. Each route
in the routing table indicates the next hop for a particular destination. The next hop refers to the outgoing
interface and gateway to use for forwarding the packet. The next hop can be the destination of the packet or
another router along the path to the destination. If the next hop isn’t the destination, the next router in the path
routes the packet to the next hop. The routing process is repeated on each router along the path until the
packet reaches its destination.

To route packets, FortiGate performs a route lookup to identify the best route to the destination. The best
route is the most specific route to the destination. If FortiGate finds duplicate routes—multiple routes to the
same destination—it uses various route attributes as a tiebreaker to determine the best route.

Routing takes place before most security features. For example, routing precedes firewall policy evaluation,
content inspection, traffic shaping, and source NAT (SNAT). This means that the security actions that
FortiGate performs depend on the outgoing interface determined by the routing process. This also means that
your security policy configuration must follow your routing configuration, and not the opposite.

FortiGate 7.6 Administrator Study Guide 86

 Routing

Route Lookup
• For any session, FortiGate performs a route lookup twice:
• For the first packet sent by the originator
• For the first reply packet coming from the responder
• Routing information is written to the session table
• All other packets for that session will use the same path
• No more route lookups done unless the session is impacted by a routing change
• Route information on the session is flushed and new route lookups are performed

© Fortinet Inc. All Rights Reserved. 6

For each session, FortiGate performs two route lookups:

• For the first packet sent by the originator
• For the first reply packet coming from the responder

After completing these two lookups, FortiGate writes the routing information to its session table. Subsequent
packets are routed according to the session table, not the routing table. So, all packets that belong to the
same session follow the same path. However, there is an exception to this rule: if there is a change in the
routing table that impacts the session, then FortiGate removes the route information for the session table, and
then performs additional route lookups to rebuild this information.

FortiGate 7.6 Administrator Study Guide 87

 Routing

RIB and FIB

• FortiGate maintains two tables containing routing information: RIB and FIB

• RIB
• Standard routing table containing active (or best) connected, static, and dynamic routes
• Visible from the GUI and CLI

• FIB
• Routing table from a kernel perspective
• Composed mostly of RIB entries, plus some system-specific entries
• Used for route lookups
• Visible from the CLI with the command get router info kernel

© Fortinet Inc. All Rights Reserved. 7

FortiGate maintains its routing information in two tables: RIB and FIB. The routing table, also known as the
routing information base (RIB), is a standard routing table containing active (or the best) connected, static,
and dynamic routes. The forwarding information base (FIB) can be described as the routing table from the
kernel point of view, and contains mostly RIB entries plus some system-specific entries required by FortiOS.

When FortiGate performs a route lookup, it checks the FIB and not the RIB. However, because the FIB is
composed mostly of RIB entries, a route lookup mainly involves checking routes from the RIB. For this
reason, the route lookup is often referred to as the routing table lookup process. Nonetheless, it is more
accurate to refer to a route lookup as a FIB lookup process.

You can display the RIB entries on the FortiGate GUI and CLI. You can display FIB entries on the FortiGate
CLI only.

This lesson focuses on the RIB (or routing table) only. You will learn more about it, including how to monitor
its entries, in this lesson.

FortiGate 7.6 Administrator Study Guide 88

 Routing

Route Lookup Process Regular

Forward
Match traffic
Start of route lookup policy Action? Forward packet
routes

No match Stop policy

routing
ISDB Match
routes

No match

SD-WAN Match
rules

No match

Route Match
cache

No match
Connected
Static Match
Routing table FIB
Dynamic
No match
Drop packet
© Fortinet Inc. All Rights Reserved. 8

The flowchart on this slide describes the route lookup process in FortiOS.

First, FortiGate checks the policy routes. If there is a match, and the selected action is Forward Traffic,
FortiGate routes the packet accordingly, as long as the policy route passes the forwarding information base
(FIB) validation process. If the selected action is Stop Policy Routing, FortiGate moves on to check its route
cache, if applicable.

If the packet doesn’t match any of the policy routes, FortiGate moves on to check the ISDB routes first, and
then the SD-WAN rules.

Next, FortiGate checks the FIB, which is the table that is used to perform standard routing. If the packet
doesn’t match any of the routes in the FIB, FortiGate drops the packet and sends an ICMP destination
network unreachable message to the sender.

FortiGate 7.6 Administrator Study Guide 89

 Routing

Static Routes
• Configured manually, by an administrator
• Simple matching of packets to a route, based on the packet destination IP address
Network > Static Routes

Default route

© Fortinet Inc. All Rights Reserved. 9

One type of manually configured route is called a static route. When you configure a static route, you are
telling FortiGate, “When you see a packet whose destination is within a specific range, send it through a
specific network interface, towards a specific router.” You can also configure the distance and priority so that
FortiGate can identify the best route to any destination matching multiple routes. You will learn about distance
and priority in this lesson.

For example, in simple home networks, DHCP automatically retrieves and configures a route. Your modem
then sends all outgoing traffic through your ISP internet router, which can relay packets to their destination.
This is typically referred to as a default route, because all traffic not matching any other routes will, by default,
be routed using this route. The example shown on this slide is a default route. The destination subnet value of
[Link]/[Link] matches all addresses within any subnet. Most FortiGate devices deployed at the edge
of the network have at least one of these default routes to ensure internet traffic is forwarded to the ISP
network.

Static routes are not needed for subnets to which FortiGate has direct Layer 2 connectivity.

FortiGate 7.6 Administrator Study Guide 90

 Routing

Static Routes With Named Addresses

• Firewall addresses set to type Subnet or FQDN can be used as destinations for static
routes
Policy & Objects > Addresses Network > Static Routes

© Fortinet Inc. All Rights Reserved. 10

If you create a firewall address object with the type Subnet or FQDN, you can use that firewall address as the
destination of one or more static routes. First, enable Routing configuration in the firewall address
configuration. After you enable it, the firewall address object becomes available for use in the Destination
drop-down list for static routes with named addresses.

FortiGate 7.6 Administrator Study Guide 91

 Routing

Internet Services Routing

• Route well-known internet services through specific interfaces
Policy & Objects > Internet Service Database Network > Static Routes

Database containing IP
addresses, protocols, and port
numbers used by most
common Internet services

© Fortinet Inc. All Rights Reserved. 11

What happens if you need to route traffic to a public internet service (such as Amazon-AWS or Apple Store)
through a specific WAN link? Say you have two ISPs and you want to route Netflix traffic through one ISP and
all your other internet traffic though the other ISP. To achieve this goal, you need to know the Netflix IP
addresses and configure the static route. After that, you must frequently check that none of the IP addresses
have changed. The internet service database (ISDB) helps make this type of routing easier and simpler. ISDB
entries are applied to static routes to selectively route traffic though specific WAN interfaces.

Even though they are configured as static routes, ISDB routes are actually policy routes and take precedence
over any other routes in the routing table. As such, ISDB routes are added to the policy routing table.

FortiGate 7.6 Administrator Study Guide 92

 Routing

Routing Monitor
• Routing table (Static & Dynamic) view Dashboard > Network > Static & Dynamic Routing
• Contains best routes (active routes):
• Connected, static, and dynamic routes
• Doesn’t contain:
• Inactive, standby, and policy routes

Display connected,
static, and dynamic
routes

Route type

© Fortinet Inc. All Rights Reserved. 12

The routing monitor widget on the dashboard page enables you to view the routing table and policy route table
entries. The routing table contains the best routes (or active routes) of the following types:

• Static: manual routes that are configured by the administrator.

• Connected: automatic routes added by FortiOS after an interface is assigned an IP address. A connected
route references the interface IP address subnet.
• Dynamic: routes learned using a dynamic routing protocol such as BGP or OSPF. FortiGate installs these
routes automatically in the routing table and indicates the dynamic routing protocol used.

To view the routing table entries, select Static & Dynamic, as shown on this slide. However, keep in mind
that the routing table doesn’t contain the following routes:

• Inactive routes: These are static and connected routes with interfaces that are administratively down or
with links that are down. Static routes are marked inactive when the link health monitor detects that their
gateway is dead.
• Standby routes: These are active routes that are removed from the routing table because they are
duplicate and have higher distances. Some examples of standby routes are:
• A second static default route with a higher distance than another static default route
• A dynamic route such as BGP or OSPF, to the same destination as another static route. However,
the dynamic route is not displayed in the routing table because the static route has a lower
distance.
• Policy routes: These include regular policy routes, ISDB routes, and SD-WAN rules. Policy routes are
viewed in a separate table—the policy route table. You will learn more about policy routes in another
lesson.

FortiGate 7.6 Administrator Study Guide 93

 Routing

Route Attributes
• Each route in the routing table has the following attributes:
• Network Dashboard > Network > Static & Dynamic Routing
• Gateway IP
• Interfaces
• Distance
• Metric Enable the Metric
column (disabled
• Priority by default)

# get router info routing-table all Display routing table entries

Codes: K - kernel, C - connected, S - static, R - onRIP, B - BGP
the CLI
…output omitted…
Routing table for VRF=0
S* [Link]/0 [10/0] via [Link], port1, [1/0]
C [Link]/24 is directly connected, port3
C [Link]/24 is directly connected, port1
C [Link]/24 is directly connected, port2
C [Link]/24 is directly connected, port8

© Fortinet Inc. All Rights Reserved. 13

Each of the routes listed in the routing table includes several attributes with associated values.

The Network column lists the destination IP address and subnet mask to match. The Interfaces column lists
the interface to use to deliver the packet.

The Distance, Metric, and Priority attributes are used by FortiGate to make various route selection
decisions. You will learn about each of these in this lesson.

This slide also shows the command you can run to display the routing table on the FortiGate CLI. The get
router info routing-table all command displays the same route entries as the routing monitor
widget on the FortiGate GUI.

FortiGate 7.6 Administrator Study Guide 94

 Routing

Distance
• First tiebreaker for duplicate routes (best route selection)
• The lower the distance, the higher the preference
• Set by the administrator (except connected routes)
• Best route selection
• Route with lowest distance is installed in the RIB
• Standby routes (higher distance) are not installed in the RIB
• They are installed in the routing table database

• Avoid multiple equal-distance duplicate routes but different protocol

• FortiGate keeps the route that was learned last

© Fortinet Inc. All Rights Reserved. 14

Distance, or administrative distance, is the first tiebreaker that routers use to determine the best route for a
particular destination. If there are two or more routes to the same destination (duplicate routes), the lowest-
distance route is considered the best route and, as a result, is installed in the routing table. Other lower-
distance routes to the same destination are standby routes and, as a result, are not installed in the routing
table. Instead, they are installed in the routing table database.

FortiGate 7.6 Administrator Study Guide 95

 Routing

Distance (Contd)
• Default distance per route type:
Connected Static Static Static Static EBGP OSPF IS-IS RIP IBGP
(SD-WAN zone) (DHCP) (Manual) (IKE)
0 1 5 10 15 20 110 115 120 200

Dashboard > Network > Static & Dynamic Routing

© Fortinet Inc. All Rights Reserved. 15

You can set the distance for all route types except connected and IS-IS routes—both are hardcoded and their
distance value cannot change. This slide shows the default values per type of route.

In case FortiGate learns two equal-distance routes to the same destination but that are sourced from different
protocols, then FortiGate installs in the routing table the route that was learned last. For example, if you set
the distance of BGP routes to 110, and there is another OSPF route to the same destination using the default
administrative distance (110), then FortiGate keeps whichever route was learned last in the routing table.
Because this behavior can lead to different results based on the timing of events, then it’s not recommended
to configure different-protocol routes with the same distance.

FortiGate 7.6 Administrator Study Guide 96

 Routing

Metric
• Tiebreaker for same-protocol duplicate dynamic routes
• The lower the metric, the higher the preference
• Best route is installed in the routing table and other duplicate routes in the routing table
database
• The calculation method differs among routing protocols
Dashboard > Network > Static & Dynamic Routing

© Fortinet Inc. All Rights Reserved. 16

When a dynamic route protocol learns two or more routes to the same destination, it uses the metric as a
tiebreaker to identify the best route. The lower the metric, the higher the preference. The dynamic routing
protocol then installs the best route in the routing table and the higher-metric routes in the routing table
database. Note that the metric is used as tiebreaker for same-protocol dynamic routes, and not between
different-protocol dynamic routes.

The metric calculation differs among routing protocols, and the details are not covered in this course. For
example, RIP uses the hop count, which is the number of routers the packet must pass through to reach the
destination. OSPF uses cost, which is determined by the link bandwidth.

FortiGate 7.6 Administrator Study Guide 97

 Routing

Priority
• Tiebreaker for static routes with same distance Network > Static Routes

• All static routes with equal distance are installed in

the routing table, even if they have different priorities
• Routes with lower priorities are preferred routes
• Default value: 1
• Best route is used during route lookup
Dashboard > Network > Static & Dynamic

Priority set to 10
(default value is 1)

© Fortinet Inc. All Rights Reserved. 17

When there are two or more duplicate static routes that have the same distance, FortiGate installs all of them
in the routing table.

The priority setting enables administrators to break the tie among static routes. During the route lookup
process, FortiGate selects the best route—that is, the static route with the lowest priority among all the equal-
distance, duplicate static routes. The lower the priority value, the higher the preference.

The priority attribute applies to all routes except connected routes and is set to 1 by default.

For dynamic routes, you can change the priority of BGP routes only. The priority of other dynamic routes is
hardcoded to 1. In dynamic routes, the priority value is useful for advanced routing deployments involving SD-
WAN and multiple virtual routing and forwarding (VRF) IDs. A detailed explanation of how the priority attribute
is beneficial for such cases is outside the scope of this course.

For static routes, you can configure the priority settings in the Advanced Options section, as shown on this
slide.

To view the priority in the routing monitor widget, you must enable the Priority column (disabled by default).
You can also view the priority in the routing table on the FortiGate CLI.

FortiGate 7.6 Administrator Study Guide 98

 Routing

Routing Table—CLI
# get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default
Priority/Weight
Routing table for VRF=0
S* [Link]/0 [10/0] via [Link], port1, [1/0]
C [Link]/24 is directly connected, port3
C [Link]/24 is directly connected, port1
C [Link]/24 is directly connected, port2
C [Link]/24 is directly connected, port8

Distance/Metric
Source

© Fortinet Inc. All Rights Reserved. 18

The CLI command shown on this slide displays all entries in the routing table. The routing table displays the
routes that make it the best active routes to a destination.

The left-most column indicates the route source. Route attributes are shown inside square brackets. The first
number, in the first pair of attributes, is distance, which applies to both dynamic and static routes. The second
number is metric, which applies to dynamic routes only.

Static routes and dynamic routes also have priority and weight attributes, which are shown as the last pair of
attributes for the respective route. In the case of dynamic routes, the weight is always zero.

This command doesn't show standby or inactive routes, which are present in the routing table database only.
For example, when two static routes to the same destination subnet have different distances, the one with the
lower distance is installed in the routing table, and the one with the higher distance in the routing table
database.

FortiGate 7.6 Administrator Study Guide 99

 Routing

GUI Route Lookup Tool Dashboard > Network > Static & Dynamic Routing
• Look up route by:
• Destination address (required)
• Destination port, source address, source port,
protocol, and source interface (optional)
• If all criteria are provided:
You are redirected to the policy
• FortiGate checks both routing table and policy route page if you enter all attributes
table entries
• Otherwise, FortiGate checks routing table entries only
• Matching route is highlighted

Matching route

© Fortinet Inc. All Rights Reserved. 19

You can perform a route lookup on the routing monitor widget by clicking Route Lookup. Then, you must
indicate at least the destination address to look up for, and optionally, the destination port, source address,
source port, protocol, and source interface.

The way the route lookup works is as follows:

• If you don’t provide all lookup criteria, FortiGate considers only the routing table entries. FortiGate then
highlights the matching route, if any.
• If you provide all lookup criteria, FortiGate considers both routing table and policy table entries. If the
lookup matches a policy route, the GUI redirects you to the policy route page, and then highlights the
corresponding matching policy route.

The example on this slide shows a route lookup tool for [Link] and TCP as destination address and
protocol, respectively. Because the administrator doesn’t provide all criteria, FortiGate considers the routing
table entries only. Then, the route lookup highlights the static default route as the matching route.

FortiGate 7.6 Administrator Study Guide 100

 Routing

Reverse Path Forwarding

• IP anti-spoofing protection • Set RPF mode (default = disable):
• Source IP is checked for a return path config system settings
set strict-src-check [disable | enable]
• RPF check is only carried out on: end
• The first packet in the session, not on a reply
Strict mode
• Two modes:
• Feasible path (default; formerly loose)
• Return path doesn’t have to be the best route • Disable RPF (default = enable):
• Strict config system interface
• Return path must be the best route edit <interface>
set src-check disable
• If RPF check fails, debug flow shows: next
• reverse path check fail, drop end

© Fortinet Inc. All Rights Reserved. 20

The RPF check is a mechanism that protects FortiGate and your network from IP spoofing attacks by
checking for a return path to the source in the routing table.

The premise behind the RPF check is that if FortiGate receives a packet on an interface, and FortiGate
doesn’t have a route to the packet source address through the incoming interface, then the source address of
the packet could have been forged, or the packet was routed incorrectly. In either case, you want to drop that
unexpected packet, so it doesn’t enter your network.

FortiGate performs an RPF check only on the first packet of a new session. That is, after the first packet
passes the RPF check and FortiGate accepts the session, FortiGate doesn’t perform any additional RPF
checks on that session.

There are two RPF check modes:

• Feasible path: Formerly known as loose, it’s the default mode. In this mode, FortiGate verifies that the
routing table contains a route that matches the source address of the packet and the incoming interface.
The matching route doesn’t have to be the best route in the routing table for that source address. It just has
to match the source address and the incoming interface of the packet.

• Strict: In this mode, FortiGate also verifies that the matching route is the best route in the routing table.
That is, if the routing table contains a matching route for the source address and incoming interface, but
there is a better route for the source address through another interface, then, the RPF check fails.

This slide also shows how to change the RPF check mode on the FortiGate CLI, as well as how to disable the
RPF check on the interface level.

FortiGate 7.6 Administrator Study Guide 101

 Routing

Lesson Progress

Routing on FortiGate

ECMP Routing
© Fortinet Inc. All Rights Reserved. 21

Good job! You now understand routing on FortiGate.

Now, you will learn about equal cost multipath (ECMP) routing.

FortiGate 7.6 Administrator Study Guide 102

 Routing

ECMP Routing

Objectives
• Implement route redundancy and load balancing

© Fortinet Inc. All Rights Reserved. 22

After completing this lesson, you should be able to achieve the objective shown on this slide.

By demonstrating competence in ECMP routing, you will be able to implement routing load balancing.

FortiGate 7.6 Administrator Study Guide 103

 Routing

ECMP
• Same-protocol routes with equal:
• Destination subnet
• Distance
• Metric
• Priority
• ECMP routes are installed in the RIB
• Traffic is load balanced among routes

© Fortinet Inc. All Rights Reserved. 23

So far, you’ve learned about the different route attributes that FortiGate looks at to identify the best route to a
destination.

But what happens when two or more routes of the same type have the same destination, distance, metric, and
priority? These routes are called equal cost multipath (ECMP) routes, and FortiGate installs all of them in the
routing table. FortiGate also load balances the traffic among the ECMP routes.

FortiGate 7.6 Administrator Study Guide 104

 Routing

ECMP (Contd) Dashboard > Network > Static & Dynamic

Two ECMP static routes

Two ECMP BGP routes

Two ECMP OSPF routes

# get router info routing-table all

…output omitted…
Routing table for VRF=0
S* [Link]/0 [10/0] via [Link], port1, [5/0]
[10/0] via [Link], port2, [5/0]
C [Link]/24 is directly connected, port3
C [Link]/24 is directly connected, port4
B [Link]/24 [200/0] via [Link] (recursive is directly connected, port3), 00:07:04, [1/0]
[200/0] via [Link] (recursive is directly connected, port4), 00:07:04, [1/0]
O [Link]/24 [110/2] via [Link], port3, 00:15:12, [1/0]
[110/2] via [Link], port4, 00:15:12, [1/0]
C [Link]/24 is directly connected, port1
C [Link]/24 is directly connected, port2

© Fortinet Inc. All Rights Reserved. 24

The example on this slide shows two ECMP static routes, two ECMP BGP routes, and two ECMP OSPF
routes. For each ECMP group, the destination subnet, distance, metric, and priority are the same.

The result is that FortiGate installs both routes of each ECMP group in the routing table. This lesson,
however, focuses on ECMP static routes only.

FortiGate 7.6 Administrator Study Guide 105

 Routing

ECMP Load Balancing Algorithms

• Source IP (default)
• Sessions sourced from the same address use the same route
• Source-destination IP
• Sessions with the same source and destination address pair use the same route
• Weighted
• Applies to static routes only
• Sessions are distributed based on route, or interface weights
• The higher the weight, the more sessions are routed through the selected route
• Usage (spillover)
• One route is used until the bandwidth threshold is reached, then the next route is used

© Fortinet Inc. All Rights Reserved. 25

ECMP can load balance sessions using one of the following four algorithms:
• Source IP: This is the default algorithm. FortiGate uses the same ECMP route to route sessions sourced
from the same address.
• Source-destination IP: FortiGate uses the same ECMP route to route sessions with the same source-
destination IP address pair.
• Weighted: Applies to static routes only. FortiGate load balances sessions based on the route weight or the
respective interface weight. The higher the weight, the more sessions FortiGate routes through the
selected route.
• Usage (spillover): FortiGate sends sessions to the interface of the first ECMP route until the bandwidth of
the interface reaches the configured spillover limit. After the spillover limit is reached, FortiGate uses the
interface of the next ECMP route.

FortiGate 7.6 Administrator Study Guide 106

 Routing

Configuring ECMP
• If SD-WAN is disabled, the ECMP algorithm is set on the CLI:
config system settings
set v4-ecmp-mode [source-ip-based | weight-based | usage-based | source-dest-ip-based]
end

• Configure weight values on the CLI on the interface level (left) and route level (right):
config system interface config router static
edit <interface name> edit <id>
set weight <0-255> Default weight for set weight <0-255>
static routes using
next next
the interface
end end

• Configure spillover thresholds on the CLI (kbps):

config system interface
edit <interface name>
set spillover-threshold <0-16776000>
set ingress-spillover-threshold <0-16776000>
next
end

© Fortinet Inc. All Rights Reserved. 26

If SD-WAN is disabled, you can change the ECMP load balancing algorithm on the FortiGate CLI using the
commands shown on this slide.

When SD-WAN is enabled, FortiOS hides the v4-ecmp-mode setting and replaces it with the load-
balance-mode setting under config system sdwan. That is, when you enable SD-WAN, you control the
ECMP algorithm with the load-balance-mode setting.

For spillover to work, you must also configure the egress and ingress spillover thresholds, as shown on this
slide. If you disable SD-WAN, FortiGate selects the lowest numbered interface first. The thresholds are set to
0 by default, which disables spillover check.

For a weighted algorithm, you must configure the weights at the interface level or route level, as shown on this
slide. If two or more routes are added to the routing table, and you set v4-ecmp-mode to weight-based,
FortiGate routes sessions based on the weight value of each route as a percentage.

FortiGate 7.6 Administrator Study Guide 107

 Routing

ECMP Example
User A
[Link]/24

port1 [Link]/24
[Link]/24
[Link]/24
[Link]/24 port3
port2

User B
[Link]/24 FGT # get router info routing-table all
…output omitted…

S [Link]/24 [10/0] via [Link], port1, [5/0]

[10/0] via [Link], port2, [5/0]
C [Link]/24 is directly connected, port1
C [Link]/24 is directly connected, port2
C [Link]/24 is directly connected, port3

Distance Priority

© Fortinet Inc. All Rights Reserved. 27

In the scenario shown on this slide, FortiGate has ECMP routes for the [Link]/24 subnet on port1 and
port2. Using the default ECMP algorithm (source IP based), FortiGate may use any of the two routes to route
traffic from user A and user B.

In the example shown on this slide, FortiGate selects the route over port1 for user A, and the route over port2
for user B. FortiGate continues to use the same selected routes for the same traffic. If the route over port1 is
removed from the routing table, FortiGate automatically starts to forward the traffic sourced from both users
and destined to [Link]/24 through port2.

ECMP enables you to use multiple paths for the same destination, as well as provide built-in failover. Usually,
you want to use ECMP for mission-critical services that require high availability. Another reason to use ECMP
is for bandwidth aggregation. That is, you can leverage the bandwidth of multiple links by load balancing
sessions across them.

While ECMP enables you to leverage multiple WAN links on FortiGate, you may want to use SD-WAN
because of the additional benefits.

FortiGate 7.6 Administrator Study Guide 108

 Routing

Default ECMP Algorithm vs. SD-WAN ECMP Algorithm

ECMP (v4-ecmp-mode) SD-WAN (load-balance-mode)
Both control ECMP algorithms
Not available when SD-WAN is enabled Not available when SD-WAN is disabled
Doesn’t support volume algorithm Support volume algorithm
Uses the weight defined in the static route Uses the SD-WAN member weight
Uses the interface spillover thresholds Uses the SD-WAN member spillover thresholds

• Volume algorithm:
• FortiGate tracks the cumulative number of bytes of the member
• The higher the member weight, the higher the target volume, the more traffic is sent to it

© Fortinet Inc. All Rights Reserved. 28

When you enable SD-WAN, FortiOS hides the v4-ecmp-mode setting and replaces it with the load-
balance-mode setting under config system sdwan. That is, after you enable SD-WAN, you now control
the ECMP algorithm with the load-balance-mode setting.

There are some differences between the two settings. The main difference is that load-balance-mode
supports the volume algorithm, and v4-ecmp-mode does not. In addition, the related settings such as weight
and spillover thresholds are configured differently. That is, when you enable SD-WAN, the weight and
spillover thresholds are defined on the SD-WAN member configuration. When you disable SD-WAN, the
weight and spillover thresholds are defined on the static route and interface settings, respectively.

When you set the ECMP algorithm to volume—this is when SD-WAN is enabled, FortiGate load balances
sessions across members based on the measured interface volume and the member weight. That is, the
volume algorithm instructs FortiGate to track the cumulative number of bytes of each member and to
distribute sessions based on the weight. The higher the weight, the higher the target volume of the interface
and, as a result, the more traffic FortiGate sends to it.

FortiGate 7.6 Administrator Study Guide 109

 Routing

Knowledge Check
1. The priority attribute is a tiebreaker for which type of routes?
A. Static
B. Connected

2. Which attribute does FortiGate use to determine the best route for same-protocol,
duplicate dynamic routes?
A. Priority
B. Metric

3. What is the default ECMP algorithm on FortiGate?

A. Weighted
B. Source IP

© Fortinet Inc. All Rights Reserved. 29

FortiGate 7.6 Administrator Study Guide 110

 Routing

Lesson Progress

Routing on FortiGate

ECMP Routing
© Fortinet Inc. All Rights Reserved. 30

Congratulations! You have completed this lesson.

Now, you will review the objectives covered in this lesson.

FortiGate 7.6 Administrator Study Guide 111

 Routing

Review
 Configure static routing
 Interpret the routing table on FortiGate
 Implement route redundancy and load balancing

© Fortinet Inc. All Rights Reserved. 31

This slide shows the objectives that you covered in this lesson.

By mastering the objectives covered in this lesson, you learned how to configure, monitor, and load balance
routes on FortiGate.

FortiGate 7.6 Administrator Study Guide 112