Technical Tip: Routing in FortiGate (route-lookup-process) Print Article

Products
FortiGate

Description

This article describes how FortiGate performs route lookup and select the outgoing interface.

Solution

By design and by default FortiGate performs two routing lookups:

- One on the first packet sent by the originator.
- Another one on the first reply packet coming from the responder.

How does FortiGate decide routes? FortiGate has multiple routing module blocks shown in the
below flow diagram.

- First, FortiGate searches its policy routes. View it using the command # diagnose firewall
proute list. If there is a match in a policy route, and the action is Forward Traffic, FortiGate
routes the packet accordingly.
- If the action is Stop Policy Routing, FortiGate goes to the next table, which is the route cache.
view that content using the CLI command # diagnose ip rtcache list.
- If there is no match in the policy route, then FortiGate looks for the SD-WAN rules, finds a
matching entry lookup, if there is a match, it will forward the packet immediately and stop
traversing the routing tables.

Note.
SD-WAN service rules are policy routes which allow routeing specific traffic over specific SD-
WAN members.
However, regular policy routes have precedence over SD-WAN policy routes.

- Finally, FortiGate searches the forwarding information base (FIB).

 The FIB is similar to the routing table generated by multiple routing protocols (main routing
table) and is the table used for packet forwarding.
If there’s no match in any of those tables, FortiGate drops the packet because it is unroutable.

To View main routing table (# get router info routing-table all) and FIB routes are also
known as kernel routes (# get router info kernel).

Note.
FortiOS 6.4.0 & 6.2.3, SD-WAN policy routes are skipped when the dst-ip for the traffic belongs
to a directly connected subnet. 

Related Articles
Technical Tip: Multiple default routes where SD-WAN rules are not preferred

Last Modified Date: 10-13-2020 Document ID: FD50169