Routing and FortiOS Networking
Three decisions, not one
FortiOS separates decisions that exam questions deliberately blur: (1) policy-route and SD-WAN rule evaluation, which happens before the routing table and is cached for the life of a session; (2) longest-prefix match in the routing table, where only routes of the lowest administrative distance for that prefix become candidates; (3) forwarding checks such as reverse-path forwarding and interface/zone membership.
Know the default distances: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200. Two routes to the same prefix are compared by distance first. Priority is only a tiebreaker between routes of equal distance - it is not a failover knob. Classic trap: two static defaults with priorities 5 and 10 do not provide backup; only the lower-priority-value route (0 beats 5) is installed and the other stays inactive. ECMP installs multiple paths only when distance and priority match.
Second trap: policy routes beat static and dynamic routes outbound, but the return path is still chosen from the normal routing table, which produces asymmetric routing and RPF drops. Default RPF is feasible path (a return route need only exist in the RIB); strict source check also requires the same incoming interface.
Worked example: default via port1 at distance 5 and via port2 at distance 10 - only port1 is in the FIB. Set both to distance 10 with equal priority for ECMP, or use SD-WAN rules with health checks for per-application steering.
Verify with get router info routing-table all, get router info routing-table database (shows routes not selected), and diagnose ip route list.