I85PREP
⌘ K
FCSS Enterprise Firewall 7.6 study materials
FCSS Enterprise Firewall 7.6 study resources

FCSS Enterprise Firewall 7.6: Advanced Routing

FCSS Enterprise Firewall 7.6 · Work through your exam, one topic at a time.

All guide sections

Advanced Routing

Advanced Routing

Advanced Routing tests route selection and control-plane protocols: static and policy routes, OSPF, BGP, RIP, redistribution, ECMP, and how routing interacts with SD-WAN, VDOMs and HA. Expect scenarios where two paths to the same prefix exist and you must say which one wins.

Core rules

  • Lookup order. For new sessions the FortiGate consults policy routes (config router policy) before the routing table, then applies longest-prefix match, then administrative distance, then priority; equal distance and priority produce ECMP.
  • Distances. Connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200. This ordering explains most questions about an apparently ignored static route.
  • Static routes need a reachable gateway and the correct egress device; a route whose gateway cannot be resolved is not installed. Floating statics simply use a higher distance.
  • OSPF. Areas (backbone 0.0.0.0), network statements with wildcard masks, hello/dead timers of 10/40 seconds on broadcast links, interface cost, MD5 or SHA authentication, and default-information-originate to export a default.
  • BGP. remote-as, ebgp-multihop, next-hop-self for iBGP peers, prefix-lists and route-maps for filtering and redistribution, and multipath for load sharing.
  • Reverse path forwarding. Configured per interface as strict, loose or disabled; asymmetric paths need it relaxed or packets are dropped before policy lookup.

Worked example

A site has a static default to ISP-A (distance 10), an eBGP-learned default (distance 20) and an OSPF-learned default from the core (distance 110). Traffic leaves via ISP-A. To prefer BGP, raise the static route to distance 250 so eBGP wins; OSPF remains a backup only if BGP withdraws. Reasoning: distance is compared only after prefix lengths tie, and the kernel installs and uses just the best route per prefix.

Traps

Forgetting set device, so the route points at the wrong interface; recursive routing where the next hop is reachable only through the route being installed; redistributing without route-maps and looping routes back; assuming a new policy route affects sessions that are already established; writing wildcard masks as subnet masks in OSPF network statements.