Routing and Network Configuration
Core concepts
FortiGate routing is destination-based with longest-prefix match, plus policy routes and SD-WAN rules that can override the routing table for specific traffic. Know the components: interfaces (physical, VLAN, aggregate, zone), static routes with distance and priority, dynamic routing (OSPF, BGP), and the reverse path forwarding check. Administrative distance breaks ties between routes to the same destination; lower distance wins, and priority breaks ties at equal distance.
Interfaces and zones
VLAN interfaces are subinterfaces tied to a parent; zones group interfaces so a single policy can reference multiple segments. Traps appear around interface roles (WAN/LAN/DMZ) and the fact that changing a role can alter default behavior. Another classic trap: an interface with a conflicting subnet or an administrative access setting that blocks management traffic.
Verification mindset
Questions often describe "traffic not passing" and expect you to reason about route lookup, policy route precedence, and RPF. Policy routes are checked before the routing table; if a policy route matches, the routing table is bypassed. Asymmetric routing can trip RPF, causing drops even when a valid route exists.
Worked example
Two static routes to 10.0.0.0/8 exist: one via port1 with distance 10, another via port2 with distance 20. The port1 route is preferred. If port1 fails and the route is removed, the port2 route becomes active. If both had distance 10, the lower priority value wins. Remember: distance first, then priority, then longest prefix-prefix length is actually evaluated before distance, so a /24 always beats a /8 regardless of distance.
Traps to watch
- Longest-prefix match outranks administrative distance.
- Policy routes take precedence over the routing table for matching traffic.
- RPF and asymmetric paths cause hard-to-see drops.