5.1 Static Routing, Policy Routes & Reverse Path Forwarding

5.1 Static Routing, Policy Routes & Reverse Path Forwarding

Routing in FortiOS 7.6 provides the foundational forwarding architecture for all network traffic passing through or terminating at a FortiGate device. To succeed on the Fortinet FCP - FortiGate Administrator exam, security professionals must master the precise evaluation order of static routes, administrative distance, priority tie-breaking mechanisms, Policy-Based Routing (PBR), and Reverse Path Forwarding (RPF) anti-spoofing security checks.

---

1. FortiOS Routing Information Base (RIB) vs. Forwarding Information Base (FIB)

FortiOS maintains two distinct routing tables in memory to optimize control plane routing logic and data plane forwarding performance:

• Routing Information Base (RIB): The master database maintained by the FortiOS routing daemon (routed). It contains all learned routes from all routing sources (connected interfaces, static routes, BGP, OSPF, RIP).
• Forwarding Information Base (FIB): The compiled active routing table installed in the FortiOS kernel. Only the best paths selected from the RIB are populated into the FIB. High-speed hardware acceleration NP7/NP6 (Network Processors) offload forwarding decisions directly from the FIB.

FortiOS Route Selection Tie-Breaking Order

When multiple candidate routes to a destination exist, FortiOS evaluates candidate routes using a strict four-step hierarchical process:

1. Longest Prefix Match (Subnet Mask Length): The route with the most specific destination subnet mask (e.g., /28 over /24, or /24 over /0) is ALWAYS selected first, regardless of administrative distance or routing protocol.
2. Administrative Distance (AD): If candidate routes have identical destination subnet masks, FortiOS compares their Administrative Distance values. The route with the lowest AD is selected and installed into the FIB.
3. Route Priority: If candidate routes have identical destination subnets AND identical AD values, FortiOS checks the route Priority. The route with the lowest numerical Priority value is preferred.
4. Equal-Cost Multi-Path (ECMP): If candidate routes have identical destination subnets, identical AD, AND identical Priority, FortiOS installs all matching routes into the FIB and load balances traffic across them using ECMP.

---

2. Static Route Configuration & Link-Health Dependencies

Static routes in FortiOS are manually defined paths. A static route remains active in the FIB only as long as its designated gateway interface is in an UP link state and its gateway IP is reachable.

Basic Static Route CLI Syntax

config router static
    edit 1
        set dst 192.168.10.0 255.255.255.0
        set gateway 10.1.1.254
        set device "port1"
        set distance 10
        set priority 10
        set comment "Primary route to Internal Branch Network"
    next
    edit 2
        set dst 192.168.10.0 255.255.255.0
        set gateway 10.2.2.254
        set device "port2"
        set distance 10
        set priority 20
        set comment "Backup route to Internal Branch Network (Floating Static)"
    next
    edit 3
        set dst 0.0.0.0 0.0.0.0
        set gateway 203.0.113.1
        set device "port1"
        set distance 10
        set priority 10
        set comment "Default Gateway for Internet Traffic"
    next
end

Key Considerations for Static Routes

• Floating Static Routes: Created by configuring a higher Administrative Distance (e.g., AD 20 vs primary AD 10). The backup route stays in the RIB but remains inactive in the FIB until the primary route fails.
• Priority-Based Primary/Secondary Routes: Created by configuring identical AD (e.g., AD 10) but different Priority values (e.g., Priority 10 vs 20). Both routes are placed in the routing table, but FortiOS forwards active sessions over the lower priority route.
• Link State Detection: If port1 link goes physically down, FortiOS immediately removes edit entry 1 from the FIB, promoting entry 2 to active forwarding state without delay.

---

3. Policy-Based Routing (PBR) Mechanics

Policy-Based Routing allows administrators to bypass standard destination-based routing table lookups and steer traffic based on specific match criteria such as source IP address, incoming interface, protocol, destination port, or Type of Service (TOS) / DSCP markings.

PBR Rule Evaluation & Mandatory Routing Table Prerequisite

CRITICAL EXAM REQUIREMENT: Policy routes are evaluated BEFORE standard routing table lookups. However, for a policy route to match and take effect, an active matching route for the destination IP address must already exist in the FortiOS routing table.

If no active route to the destination exists in the routing table (RIB/FIB), FortiOS skips the Policy Route completely and drops or rejects the traffic.

Policy Route CLI Configuration

config router policy
    edit 1
        set input-device "port3"
        set src 10.100.0.0 255.255.0.0
        set dst 0.0.0.0 0.0.0.0
        set protocol 6
        set start-port 443
        set end-port 443
        set gateway 198.51.100.1
        set output-device "port2"
        set comments "Route all internal HTTPS traffic via dedicated ISP on port2"
    next
end

Policy Route Matching Hierarchy vs. Static Routes

1. Packet arrives at FortiGate ingress interface (port3).
2. FortiOS scans the Policy Routing table sequentially from top to bottom (ID index order).
3. If parameters match (Ingress interface, Source IP, Destination IP, Protocol, Port):
   • FortiOS checks if the main routing table contains a valid active route to destination.
   • If yes: FortiOS overrides destination route lookup and forwards traffic out port2 to gateway 198.51.100.1.
   • If no: FortiOS ignores the policy route match and processes standard routing.
4. If no policy route matches: FortiOS proceeds to standard FIB destination lookup (Longest Prefix > AD > Priority).

---

4. Reverse Path Forwarding (RPF) Anti-Spoofing Security Checks

Reverse Path Forwarding (RPF) is an IP anti-spoofing mechanism designed to verify that an incoming packet's source IP address is legitimate and reachable via the ingress interface where the packet arrived.

FortiOS enforces RPF checks at the kernel level before firewall policy inspection.

Strict RPF Mode vs. Loose RPF Mode

FortiOS supports two configurable RPF operational modes:

Interface RPF Configuration CLI

config system interface
    edit "port1"
        set src-check strict
    next
    edit "port2"
        set src-check feasible-entry
    next
end

Troubleshooting RPF Drops with Packet Sniffer & Debug Flow

When packets are unexpectedly dropped due to RPF failures, administrators use CLI debug tools to identify the cause:

diagnose debug reset
diagnose debug flow filter saddr 192.168.50.100
diagnose debug flow show function-name enable
diagnose debug flow trace start 10
diagnose debug enable

If RPF fails, the debug trace output explicitly reports: id=20003 trace_id=1 msg="Reverse path forwarding check failed. Dropping packet."

To resolve RPF drop issues caused by asymmetric routing, either adjust static route priorities to align symmetric paths, switch the interface RPF mode to feasible-entry, or implement asymmetric routing settings (set asymroute enable under config system settings).