Routing and Networking
Routing fundamentals
NGFWs route between zones using a virtual router or routing instance. Route selection uses longest prefix match first, then administrative distance, then metric. Connected routes beat static; static usually beats eBGP/iBGP depending on platform defaults. ECMP installs multiple equal-cost next hops; asymmetric routing across ECMP can break stateful inspection and NAT.
Interfaces, NAT, and path
Know subinterfaces (802.1Q), VLAN tags, ARP/proxy ARP, and policy-based forwarding. NAT rewrites packets before or after route lookup depending on direction; destination NAT often requires a route to the translated address and a valid return path. MTU and TCP MSS clamping matter for tunnels and PPPoE.
Traps
Missing return routes, overlapping subnets, NAT applied to the wrong zone, and route redistribution loops. Also watch default-route versus more-specific-route questions, and whether the firewall answers proxy ARP for a NAT pool.
Rule of thumb
Troubleshoot with interface counters, ARP table, routing table for the exact destination, then the session table. A session stuck in incomplete usually means the return path is missing.
Worked example
Two static routes to 10.1.0.0/16 with equal administrative distance cause ECMP; a more specific /24 wins regardless. If a NAT'd server is unreachable, verify the inside route to the real IP and the outside route to the pool.