I85PREP
⌘ K
Fortinet FCSS NST study materials
Fortinet FCSS NST study resources

Fortinet FCSS NST: FortiGate Infrastructure and Routing

Fortinet FCSS NST · Work through your exam, one topic at a time.

All guide sections

FortiGate Infrastructure and Routing

FortiGate Infrastructure and Routing tests your command of interface roles, route selection, NAT and the diagnostic commands that explain why traffic takes a given path.

Core rules

  • Each VDOM has its own routing table. Interface roles, VLANs, administrative access and VDOM assignment must be correct before routes or policies can work.
  • FortiGate route selection uses longest prefix match, then administrative distance, then metric. ECMP installs multiple equal-cost paths; unequal-cost paths are not balanced by default.
  • Policy routes are evaluated before the main routing table for matching traffic. SD-WAN rules select members by health and SLA, so a policy route can bypass SD-WAN steering if it matches first.
  • NAT can be configured in the firewall policy or centrally with central SNAT. VIPs perform inbound DNAT; hairpin NAT needs correct source translation and a policy that allows the internal client to reach the VIP.
  • Use get router info routing-table all, diagnose sys session list, diagnose sniffer packet any and execute ping-options source to prove the actual path and source address.

Worked example

A site has ISP1 and ISP2 in an SD-WAN zone. VoIP must prefer ISP1 and guests must prefer ISP2; general traffic may use either. Create SD-WAN rules with health checks and priority: VoIP to ISP1, guest to ISP2, default load-balanced. A legacy application server must always leave via ISP1 because the vendor allows only one source IP. Add a policy route for that server with the ISP1 gateway and configure SNAT to the ISP1 address. Verify the return path and confirm the policy route is matching before the SD-WAN rule.

Traps

  • Overlapping subnets across VPN, VDOMs or interfaces, which produces ambiguous routes.
  • ECMP across links of very different bandwidth without SD-WAN health or SLA logic.
  • Adding a policy route without the matching NAT or return route.
  • Changing an interface address and leaving stale next-hop or VIP references.
  • Assuming HA automatically fixes routing; route and session state still need to converge.