Video 4 – What is IP Routing:

Firewall Traffic – traffic by the users.

Local-out Traffic – traffic by the fw itself, for example when FortiGate connects to
FortiGuard to download the new threats, or when trying to ping from FortiGate to a
device.

Fortigate has 2 options when being deployed:

🔹 1. NAT Mode (default, most common)

 FortiGate acts like a router with NAT.

 Interfaces are assigned IP addresses.

 It forwards traffic between different subnets/networks.

 Can do Source NAT (SNAT) and Destination NAT (DNAT).

 Example:

o Inside host [Link] → Internet via FortiGate.

o FortiGate translates it to the public IP [Link].

 Most enterprises use this mode because it allows segmentation, firewalling,

and hiding internal IPs.

🔹 2. Transparent Mode (a.k.a. Bridge Mode)

 FortiGate acts like a Layer 2 bridge (switch).

 Interfaces do not need IP addresses (only management interface has one).

 Traffic passes through FortiGate without changing IPs — but you can still
apply firewall policies, IPS, antivirus, web filtering, etc.

 It’s like an inline security appliance sitting between two existing networks.

 Example use case: You don’t want to redesign an existing network with IP
changes, but you want to add FortiGate security.

✅ So:

 NAT mode = FortiGate is an IP router with NAT.

 Transparent mode = FortiGate is a bridge/firewall inline with no routing/NAT.

📌 Summary: IP Routing in FortiGate

1. Routing Table

Contains routes with next-hop information for a destination. Each

entry defines the outgoing interface and gateway for forwarding the
packet. The next hop can be the destination itself or another router on
the way.

2. Best Route Selection

o FortiGate looks for the most specific route (it uses Longest Prefix
Match) to the destination.

o If duplicate routes exist, FortiGate uses route attributes (e.g., distance,

priority) as tiebreakers.

🔹 What is Longest Prefix Match:

o Example: Destination [Link] matches both [Link]/16 and

[Link]/24. /24 is selected because it is more specific.

3. Routing Precedes Security

o Routing decisions happen before most security actions (firewall policy,

content inspection, traffic shaping, SNAT).

o This means the outgoing interface from routing determines which

firewall/NAT rules will apply.

o Security configuration must follow routing decisions, not the opposite.

**Local Out Traffic - Local-out traffic is the traffic generated by FortiGate, usually
for management purposes. For example, when you ping a device from FortiGate,
that’s local-out traffic. When FortiGate connects to FortiGuard to download the
latest definitions, that’s also local-out traffic.

Video 6 – What is Route Lookup:

📌 Route Lookup in FortiGate

1. Initial Route Lookups:

FortiGate performs two route lookups per session:

o One for the first packet sent by the originator.

o One for the first reply packet from the responder.

2. Session Table

o After these two lookups, the routing information is stored in the

session table.

o All subsequent packets for that session follow the same path from the
session table (not the routing table).

3. Routing Changes

o Normally, no more lookups are performed after the initial ones.

o Exception: If the routing table changes and it impacts the session,

FortiGate flushes the old route info and performs new lookups to
update the session.

Video 7 – RIB and FIB:

🔹 RIB (Routing Information Base)

 The RIB is the main routing table that contains all active (best) routes,
whether they are:
o Connected (directly attached networks)
o Static (manually configured routes)
o Dynamic (learned via routing protocols like OSPF, BGP, RIP).
 You can view it in both the GUI and CLI.
 Think of RIB as the master list of best routes that FortiGate has chosen, you
can see all the routes, even if there are few to the same destination.
 The Command: get router info routing-table all

🔹 FIB (Forwarding Information Base)

 The FIB is the kernel-level routing table — this is what the FortiGate’s packet
forwarding engine actually uses when sending packets.
 It’s built mostly from the RIB, but not identical:
o It includes all the best routes from the RIB, but still has few "best
routes" for the same destination IP, also uses Longest Prefix Match.
o It can also include system-specific entries that are not in the RIB (for
example, policy routes, special routes needed by the kernel).
 Used directly for route lookups during forwarding.
 Can only be viewed from the CLI with The Command: get router info kernel

Video 8 – Route Lookup Process:

🔹 Step 1 – Regular Policy Routes

 What they are: Rules you create under Policy & Objects → Policy Routes.

 Match criteria: Source/destination interface, IP address, subnet, service, etc.

 Effect: If a packet matches, FortiGate forces it out the specified

interface/gateway, but only if that route also exists in the FIB (validation
step).

 Special case: If the policy action is Stop Policy Routing, FortiGate stops
checking policy routes and goes straight to cached routes/FIB (skipping isdb
routes and sd-wan rules.

👉 Example:
“All traffic from the Finance subnet ([Link]/24) going to [Link] should always
exit via WAN2 with gateway [Link].”

🔹 Step 2 – ISDB Routes

  What they are: Policy routes that use Fortinet’s Internet Service Database
(ISDB) objects.

 Why: Instead of entering raw IPs, you just reference a known service (like
Google, Office365, Zoom, etc.).

 Effect: If the destination matches the ISDB object, FortiGate routes traffic
accordingly.

👉 Example:
“All traffic to the ‘Office365’ Internet Service must always go through WAN1, not
WAN2.” (even though Office365 changes IP ranges all the time, Fortinet updates the
ISDB alone)

🔹 Step 3 – SD-WAN Rules

 What they are: Traffic steering rules that apply when you’re using SD-WAN.

 Why: Lets you select paths dynamically based on performance (latency, jitter,
loss, SLA targets).

 Effect: The rule decides which WAN member is preferred for certain traffic
types, with failover or load balancing.

👉 Example:
“Send all Zoom traffic out ISP1, but if packet loss is >2%, reroute it to ISP2
automatically.”

🔹 Step 4 – Standard Routing (FIB)

 What it is: The Forwarding Information Base, built from the Routing
Information Base (connected, static, OSPF, BGP, etc.).
here the static routes are found, if they are considered the best route from
the RIB (because all the static routes are in the RIB first).
 Effect: If no policy route, ISDB rule, or SD-WAN rule matches, traffic is routed
by the FIB using the longest prefix match.
 If no route exists → packet dropped, and FortiGate may send ICMP
Destination Unreachable.

👉 Example:
“If a packet is destined for [Link], and the FIB has a static route [Link]/16 →
gateway [Link], the traffic follows that route.”

Video 9 – Static Routes:

Static Routes – Summary

 Configured manually by the administrator.

 Define how packets should be forwarded based on their destination IP
address.
 You specify:
o Destination subnet (e.g., [Link]/0 for default route, its usually a
public subnet).
o Gateway address (next hop).
o Interface (/Outgoing interface).
o Administrative distance & priority (used if multiple routes exist).

Default Route

 A static route with destination [Link]/0 (matches all IPs).

 Ensures that if no other route matches, packets are sent to the ISP/next hop.
 Common in edge FortiGate deployments to forward unknown traffic to the
internet.

 Not needed for directly connected subnets (FortiGate already knows them).

 When the subnet is not directly connected:

Example: Your FortiGate is connected to [Link]/24, but you also need
to reach [Link]/24, which is behind another router. Here, there is a
need for static route because without this, FortiGate wouldn’t know how to
forward traffic to [Link]/24.
Example: If traffic is destined for [Link]/24, forward it out via interface
Malam (port8) to gateway [Link].”
Video 10 – Static Routes With Named Addresses:

If you create a firewall address object with the type Subnet or FQDN, you can use
that firewall address as the destination of one or more static routes. First, enable
Routing configuration in the firewall address configuration.
For that go to:
Policy & Objects > Addresses  Edit an existing address  Type must be either
Subnet or FQDN (because only those support routing)  a toggle called Routing
configuration  Enable  Save.

After you enable it, the firewall address object becomes available for use in the
Destination drop-down list for static routes with named addresses.
Video 11 – Internet Services Routing (ISDB Routing):

These Static Routes are the same exact same as ISDB Route's in the Route look-up
Process.

Video 12 – Routing Monitor:

Types Of Routes:

Static Routes

Static routes are manual entries configured by the administrator. They explicitly tell
the FortiGate device how to reach a specific destination network by defining the next
hop or gateway.

Connected Routes

Connected routes are automatically added by FortiOS whenever an interface on the

FortiGate is assigned an IP address. A connected route simply represents the subnet
directly “attached” to that interface. This does not necessarily mean that a physical
cable is connected; rather, it means that the FortiGate itself has an IP configured on
that network. For example, if you assign an interface the address [Link]/24,
FortiOS automatically creates a connected route for the subnet [Link]/24.

Dynamic Routes

Dynamic routes are routes learned automatically through routing protocols such as
BGP (Border Gateway Protocol) or OSPF (Open Shortest Path First).

Inactive Routes

Inactive routes are static or connected routes that cannot be used because the
associated interface is administratively shut down or the link is unavailable. For
example, if a cable is disconnected or the gateway cannot be reached according to
the health monitor, the static route tied to that gateway will be marked inactive.

Standby Routes

Standby routes are active routes that exist but are temporarily removed from the
routing table because another route to the same destination has a lower distance,
meaning it is preferred.

Policy Routes

Policy routes are routes created by policies rather than simple destination-based
logic. They include regular policy routes, ISDB (Internet Service Database) routes, and
SD-WAN rules. Unlike other types of routes, policy routes are not stored in the main
routing table but in a separate policy route table.
Routes Attributes:

1. Network

The Network attribute lists the destination IP address and subnet mask that must
match in order for the route to be used.

2. Interfaces

The Interfaces attribute specifies the outgoing interface that FortiGate should use to
deliver the packet. This tells the device which physical or logical port the traffic
should exit from.

3. Distance

The Distance attribute is the firtst value used by FortiGate to determine the
preference between multiple routes to the same destination. Lower distances are
preferred over higher ones. For example, a static route usually has a lower distance
than a dynamic route, so it will be chosen first.

4. Metric

The Metric attribute is the second value that helps FortiGate decide which path to
use when multiple routes exist. Metrics are often determined by dynamic routing
protocols such as OSPF or BGP and represent the “cost” of reaching a destination
(such as hop count, bandwidth, or delay). A lower metric means the path is more
favorable. IT ONLY APPLIES TO DYNAMIC ROUTES NOT STATIC ONES.

5. Priority

The Priority attribute allows administrators to influence route selection beyond

distance and metric. Applied to all routes except connected ones.

CLI command for routing table, The Command: get router info routing-table all
An example of the command output:

** In case FortiGate learns two equal-distance routes to the same destination but
that are sourced from different protocols, then FortiGate installs in the routing
table the route that was learned last. For example, if you set the distance of BGP
routes to 110, and there is another OSPF route to the same destination using the
default administrative distance (110), then FortiGate keeps whichever route was
learned last in the routing table, in the example the OSPF routes.
that’s why there is no need to configure different protocol routes with the same
distance. **
Video 20 – Reverse Path Forwarding (RPF):

RPF - The RPF check is a mechanism that protects FortiGate and your network from
IP spoofing attacks by checking for a return path to the source in the routing table.

🔹 How RPF Works

The premise behind the RPF check is that if FortiGate receives a packet on an
interface (temporarly treats it like a destination ip and dest interface) and if FortiGate
doesn’t have a route to the packet source address through the incoming interface,
then the source address of the packet could have been forged, or the packet was
routed incorrectly. In either case, you want to drop that unexpected packet, so it
doesn’t enter your network.

🔹 When RPF is Applied

FortiGate performs an RPF check only on the first packet of a new session. That is,
after the first packet passes the RPF check and FortiGate accepts the session,
FortiGate doesn’t perform any additional RPF checks on that session.

🔹 RPF Check Modes

1. Feasible Path (Loose Mode – Default)

In this mode, FortiGate verifies that the routing table contains a route that matches
the source address of the packet and the incoming interface.

 The matching route doesn’t have to be the best route in the routing table for
that source address. It just has to match the source address and the incoming
interface of the packet.

2. Strict Mode

In this mode, FortiGate also verifies that the matching route is the best route in the
routing table.

 If the routing table contains a matching route for the source address and
incoming interface, but there is a better route for the source address through
another interface, then the RPF check fails and drops the packet.
Video 23– ECMP (called equal cost multipath):
what happens when two or more routes of the same type have the same
destination, distance, metric, and priority? These routes are called equal cost
multipath (ECMP) routes, and FortiGate installs all of them in the routing table.
FortiGate also load balances the traffic among the ECMP routes.
ECMP is only relevant when SD-wan is disabled.
They do not overlap — FortiGate hides v4-ecmp-mode once SD-WAN is enabled
because SD-WAN is in charge.

ECMP Load Balancing Algorithms:

When you configure multiple static routes with the same destination and equal cost,
FortiGate can use different load balancing algorithms to decide which route/session
to pick. Here’s the breakdown:

🔹 1. Source IP (default)

 How it works:
Sessions sourced from the same IP will always use the same static route.

 Static Route Example:

Two default static routes:

o [Link]/0 → [Link] via wan1

o [Link]/0 → [Link] via wan2

If a client at [Link] starts sessions, FortiGate will always push that
client’s sessions through wan1, while another client [Link] might
consistently go through wan2.

 Use Case: Predictable session distribution, avoids per-packet reordering.

🔹 2. Source-Destination IP

 How it works:
FortiGate uses both source and destination addresses. Same
source→destination pair will always use the same static route.

 Static Route Example:

Same two default routes as above.

o [Link] → [Link] might always go out via wan1

 o [Link] → [Link] might always go out via wan2
Even though both come from the same client, the destination
matters.

 Use Case: Balances traffic better when a single host talks to multiple different
destinations.

🔹 3. Weighted

 How it works:
Only applies to static routes. Each static route can be given a weight; the
higher the weight, the more sessions will use it.

 Static Route Example:

o [Link]/0 → [Link] via wan1 weight 3

o [Link]/0 → [Link] via wan2 weight 1

Result: About 75% of new sessions go via wan1, and 25% via wan2.

 Use Case: You have a faster/fatter primary link and a slower secondary link,
but still want both in use.

🔹 4. Usage (Spillover)

 How it works:
FortiGate uses one static route until its bandwidth threshold is reached, then
spills new sessions over to the next static route.

 Static Route Example:

o [Link]/0 → [Link] via wan1 (primary, bandwidth limit 100 Mbps)

o [Link]/0 → [Link] via wan2 (secondary)

FortiGate sends all traffic via wan1 until it’s saturated, then new
sessions start to go via wan2.

 Use Case: Prefer one ISP until it’s full, then overflow to backup ISP
Video 23– Configuring ECMP:

🔹 1. Set the ECMP Algorithm

What it does:

 This defines the algorithm FortiGate will use to balance traffic when multiple
static routes exist with the same distance and priority (ECMP).

🔹 2. Configure Interface Weight

What it does:

 Assigns a weight to an interface for load balancing.

 Higher weight = more sessions are routed through that interface.

 Takes precedence over route-level weights.

3. Configure Static Route Weight

What it does:

 Assigns a weight to a specific static route in the routing table.

 Used in weight-based ECMP mode when multiple static routes point to the
same destination.
4. Configure Spillover Thresholds (Usage-based) (Kbps)

What it does:

 Sets bandwidth thresholds (in kbps) for an interface.

 Outbound traffic uses spillover-threshold.

 Inbound traffic uses ingress-spillover-threshold.

 When the threshold is reached, FortiGate moves new sessions to the next
available route.

Video 28: ECMP Algorithms VS SD-WAN ECMP Algorithms:

🔹 What does Member mean?

 In SD-WAN, a member is simply a WAN link (an interface or gateway) that is

part of the SD-WAN zone.

 Example: If you add port1 (ISP1), port2 (ISP2), and port3 (MPLS) into an SD-
WAN zone, then each of them is a member.

 So, when SD-WAN decides where to send traffic, it’s really deciding which
member (WAN link) will carry it.

🔹 What does Volume mean?

  Volume here means the amount of traffic (bytes) that has been sent through
a member.

 In the volume algorithm:

o FortiGate keeps track of how much data (in bytes) each member has
carried.

o It compares that amount against the weight assigned to the member.

o The higher the weight, the higher the traffic target volume for that
link.

🔹 Example of Volume-based load balancing

Let’s say you have two members in SD-WAN:

 ISP1 (weight = 3)

 ISP2 (weight = 1)

Now SD-WAN will try to send 75% of traffic to ISP1 and 25% to ISP2, because the
volume of bytes should match the ratio of the weights (3:1).

If FortiGate notices that ISP1 has already sent more bytes than its share, it will start
sending more to ISP2 until balance is restored.

Important:
The first command, which is: get router info routing-table all shows the FIB table,
which are the routes that are in "Active Duty". The * symbol in the FIB table only
mentions the "Default Route", it doesn’t have any other meaning.

The second command which is: get router info routing-table database shows the
entire routes database, it shows both the "Active Routes" which are the ones that
appear in the FIB table and the "Standby Routes" which are part of the RIB table.

The symbol *, not like in the FIB table, here it means it’s that route is part of the FIB
table.
and the symbol > means, it’s the selected route, even if it has no competitors its still
the selected route and the best one for that specific destination.
it is possible for a route to have the > symbol and not the * symbol. For example the
destination is unreachable, but that route will still be the best that’s why it will have
the > but It wont be used in the FIB table, that’s why it doesn’t have the * symbol.

**You can set the distance for all route types except connected and IS-IS routes—
both are hardcoded and their distance value cannot change
**metric is used as tiebreaker for same-protocol dynamic routes, and not between
different-protocol dynamic routes

**When there are two or more duplicate static routes that have the same distance,
FortiGate installs all of them in the routing table. The priority setting enables
administrators to break the tie among static routes

**The priority attribute applies to all routes except connected routes and is set to 1
by default. For dynamic routes, you can change the priority of BGP routes only. The
priority of other dynamic routes is hardcoded to 1. In dynamic routes