3.1 Static Routing & Dynamic Routing Protocols

3.1 Static Routing & Dynamic Routing Protocols

Quick Answer: Fireware OS routes packets using Longest Prefix Match (LPM) first. When multiple routes match with identical subnet masks, Fireware follows a strict administrative precedence: Directly Connected (metric 0) > Static Routes > Dynamic Routes (BGP, OSPF, RIP) > Default Route (0.0.0.0/0). Static routes require destination CIDR, next-hop gateway IP, interface binding, and metric. Dynamic routing utilizes an embedded Quagga/FRRouting engine supporting OSPFv2/v3 (link-state with Dijkstra SPF across areas), BGPv4 (path-vector over TCP 179 using Autonomous System numbers), and RIPv1/v2 (distance-vector capped at 15 hops).

Fundamentals of Layer 3 Routing in Fireware OS

The WatchGuard Firebox operates as a true stateful inspection security gateway and multi-layer network router. When operating in the standard Mixed Routing mode, the Firebox routes traffic across Layer 3 boundaries between physical interfaces, virtual local area networks (VLANs), link aggregation groups (LAGs), and virtual private network (VPN) tunnels. Unlike a simple Layer 2 transparent bridge, a Firebox in Mixed Routing mode maintains an internal Routing Information Base (RIB) and a Forwarding Information Base (FIB) to determine the precise egress interface and next-hop gateway for every transit IP packet.

The Longest Prefix Match (LPM) Rule

Every routing decision in Fireware begins with the Longest Prefix Match (LPM) algorithm. Regardless of whether a route was learned dynamically via OSPF, manually programmed as a static route, or populated by an interface IP assignment, the Firebox evaluates the destination IP address of an incoming packet against all route entries in its routing table and selects the route with the most specific subnet mask (the longest prefix length).

Consider a Firebox with the following route entries in its routing table:

• 10.0.0.0/8 learned via BGP
• 10.10.0.0/16 configured as a static route pointing to an internal downstream router
• 10.10.20.0/24 directly connected on the Trusted interface

When a packet arrives destined for host 10.10.20.45, the destination address matches all three route entries. Because /24 represents a longer (more specific) prefix than /16 or /8, the Firebox immediately selects the 10.10.20.0/24 directly connected route. Prefix length always supersedes administrative route type and metric.

---

Fireware Routing Table Precedence & Administrative Distance

When multiple routes exist for the exact same destination prefix and subnet mask (for example, two competing routes for 172.16.50.0/24), Fireware OS breaks the tie using a deterministic administrative precedence hierarchy.

Directly Connected (Metric 0)
       ↓
Static Routes (Default Metric 1, Configurable 1–255)
       ↓
Dynamic Routes (BGP [eBGP 20, iBGP 200], OSPF [110], RIP [120])
       ↓
Default Route (0.0.0.0/0 via External Interface / Multi-WAN)

1. Directly Connected Routes (Metric 0): These routes are automatically instantiated when an interface (Trusted, Optional, Custom, or External) is configured with an IP address and netmask. They possess the highest priority and cannot be overridden by static or dynamic routes with identical prefixes.
2. Static Routes: Manually configured routes take precedence over any dynamically learned route for the identical prefix. Static routes have a default metric of 1, but administrators can assign metrics from 1 to 255 to create primary and backup static paths.
3. Dynamic Routes: Routes learned via dynamic routing protocols (BGP, OSPF, RIP) populate the routing table only when no directly connected or static route matches the prefix with an equal or longer mask. Within the dynamic routing engine, standard administrative distances govern selection:
   • eBGP: Administrative Distance 20
   • OSPF: Administrative Distance 110
   • RIP: Administrative Distance 120
   • iBGP: Administrative Distance 200
4. Default Route (0.0.0.0/0): The gateway of last resort. It has the shortest possible prefix length (/0) and is evaluated only when no other route matches the packet's destination IP.

Equal-Cost Multi-Path (ECMP)

If the Firebox contains two or more static or dynamic routes to the exact same destination network with the identical prefix length and identical metric, Fireware can employ Equal-Cost Multi-Path (ECMP) routing to balance traffic flows across the available gateways using a deterministic hashing algorithm based on source and destination IP addresses.

---

Static Route Configuration Mechanics

Static routes are the most common routing mechanism configured on a Firebox. They define explicit deterministic forwarding paths for subnets that are not directly attached to a Firebox physical interface.

Required Parameters for a Static Route

When defining an IPv4 or IPv6 static route in Fireware Web UI (Network > Routes) or Policy Manager (Network > Configuration > Routes tab), the administrator must supply four core parameters:

1. Destination Network / Subnet Mask (CIDR): The target IP subnet in CIDR notation (e.g., 192.168.100.0/24).
2. Gateway IP Address (Next Hop): The IP address of the adjacent Layer 3 router or multilayer switch that knows how to reach the destination network. The next-hop gateway IP must reside within the subnet of a directly connected Firebox interface.
3. Interface Binding: The Firebox can automatically determine the egress interface based on the gateway IP address, or the administrator can explicitly bind the route to a specific interface (e.g., Eth1 - Trusted). Explicit binding ensures traffic does not egress an unexpected interface if IP assignments change.
4. Metric: An integer between 1 and 255 (default is 1). A lower metric indicates a higher route preference. By configuring two static routes to the same destination with different metrics (e.g., metric 1 for a primary fiber link and metric 10 for a backup microwave link), the administrator creates floating static routes for automatic failover.

Practical Enterprise Scenario: Downstream Layer 3 Switch

A common enterprise deployment involves a Firebox connected via its Trusted interface (10.0.1.1/24) to a core Layer 3 switch (10.0.1.2/24). The core switch manages several internal VLANs:

• VLAN 10 (Workstations): 10.0.10.0/24
• VLAN 20 (Servers): 10.0.20.0/24
• VLAN 30 (Voice): 10.0.30.0/24

Because the Firebox only has a direct interface on 10.0.1.0/24, it has no inherent knowledge of 10.0.10.0/24, 10.0.20.0/24, or 10.0.30.0/24. Without static routes, return traffic from the Internet or DMZ destined for a workstation at 10.0.10.55 would match the Firebox default route (0.0.0.0/0) and be erroneously forwarded back out the External interface to the ISP.

To correct this, the administrator creates static routes on the Firebox:

• Destination: 10.0.0.0/16 (or individual /24 subnets)
• Gateway: 10.0.1.2 (the core switch IP)
• Interface: Eth1 - Trusted
• Metric: 1

[Internet] <---> [Firebox Eth0 (External)]
                      |
                 [Firebox Eth1 (10.0.1.1/24)]
                      |
                 [Core L3 Switch (10.0.1.2/24)]
                 /         |         \
           [VLAN 10]   [VLAN 20]   [VLAN 30]
         10.0.10.0/24 10.0.20.0/24 10.0.30.0/24

Exam Tip: If a static route's next-hop gateway is unreachable because the local interface has lost its physical carrier link, Fireware removes that static route from the active forwarding table. Once the link state recovers, the static route is immediately restored.

---

The Default Route (0.0.0.0/0) & Multi-WAN Coordination

The default route (0.0.0.0/0 with netmask 0.0.0.0) matches all IPv4 destination addresses not explicitly covered by a longer prefix. In Fireware OS, default route generation is tied directly to the External interface configuration:

• When an interface is set to External and assigned a default gateway IP (either manually via static assignment or dynamically via DHCP/PPPoE), Fireware automatically adds a default route pointing to that gateway.
• If a Firebox has a single External interface, all outbound Internet traffic uses that interface default gateway.
• If the Firebox has multiple External interfaces, Fireware's Multi-WAN engine takes control of the default routing behavior.

Multi-WAN Default Route Mechanics

Under Network > Multi-WAN, the administrator selects an orchestration method that dictates how the default route operates across multiple ISPs:

• Routing Table: Default routes are evaluated strictly using the Firebox routing table metrics.
• Round-Robin: Traffic sessions matching the default route are distributed proportionally across active External interfaces based on configured bandwidth weights.
• Failover: Traffic uses a primary External interface default route exclusively; if the primary interface link monitor fails, the default route automatically switches to the secondary backup External interface.
• Interface Overflow: Traffic uses the primary External interface until its throughput reaches a predefined threshold, at which point new connections overflow to the secondary External interface.

Policy-based routing and SD-WAN actions can selectively override the Multi-WAN default route for specific traffic types (e.g., routing Microsoft 365 traffic out ISP 1 and VoIP traffic out ISP 2 regardless of the global Multi-WAN setting).

---

Dynamic Routing Protocols in Fireware

In large, complex, or rapidly expanding enterprise networks, manually maintaining static routes across dozens of subnets becomes operationally unviable. Fireware OS includes a full-featured dynamic routing engine based on the open-source Quagga / FRRouting daemon suite. Dynamic routing enables the Firebox to exchange route updates with adjacent routers, automatically recalculate forwarding paths when network links fail, and advertise local Firebox subnets to the broader enterprise.

Dynamic routing is enabled globally under Network > Dynamic Routing. Configuration is authored using a standard industry-compatible command-line configuration script syntax within Fireware Web UI or Policy Manager.

OSPF (Open Shortest Path First)

OSPF is an open-standard link-state interior gateway protocol (IGP) widely deployed within enterprise campus networks. Fireware supports both OSPFv2 (for IPv4) and OSPFv3 (for IPv6).

Key OSPF Operational Mechanics in Fireware:

1. Link-State Advertisements (LSAs): Rather than passing periodic entire routing tables (like RIP), OSPF routers flood LSAs containing information about interface states, attached subnets, and neighbor relationships. Every router in an OSPF area builds an identical Link-State Database (LSDB).

2. Dijkstra SPF Algorithm: Each router independently executes the Shortest Path First (SPF) algorithm against the LSDB to calculate a loop-free, shortest-path tree with itself at the root.

3. Hierarchical Area Design: OSPF divides networks into logical areas to minimize SPF recalculation overhead:

   • Backbone Area (Area 0 / Area 0.0.0.0): The central core of the OSPF topology. All other non-backbone areas must connect directly to Area 0 (or via virtual links).
   • Standard Non-Backbone Areas: Connected to Area 0 through Area Border Routers (ABRs). A Firebox can function as an internal router within an area or as an ABR spanning multiple areas.

4. Neighbor Adjacency States: Fireware transitions through standardized OSPF neighbor states when forming adjacencies across configured interfaces: Down → Init → 2-Way → ExStart → Exchange → Loading → Full Only when two routers achieve the Full state do they fully synchronize their LSDBs and install learned routes into the routing table.

5. OSPF Cost Metric Calculation: OSPF calculates the cost of an interface based on its bandwidth using the formula: $\text{Cost} = \frac{\text{Reference Bandwidth}}{\text{Interface Bandwidth}}$ In Fireware, the default reference bandwidth is 100 Mbps (100,000,000 bps). Under this default:

   • A 10 Mbps Ethernet link has a cost of $100 / 10 = 10$.
   • A 100 Mbps FastEthernet link has a cost of $100 / 100 = 1$.
   • A 1 Gbps Gigabit link has a cost of $100 / 1000 = 0.1$, which rounds up to the minimum integer cost of 1.
   • A 10 Gbps link also receives a cost of 1.

   Important Configuration Note: Because 100 Mbps, 1 Gbps, and 10 Gbps links all receive an identical default cost of 1, administrators managing gigabit infrastructure must customize the auto-cost reference-bandwidth parameter (e.g., setting it to 10000 Mbps) to ensure OSPF correctly prefers faster links.

6. Authentication: Fireware supports both plain-text password authentication and cryptographic MD5 authentication for OSPF packets, preventing rogue devices from injecting malicious LSAs.

BGP (Border Gateway Protocol)

BGP is a path-vector exterior gateway protocol (EGP) that powers the global Internet routing system and facilitates multi-tenant routing between disparate autonomous domains.

Key BGP Operational Mechanics in Fireware:

1. Autonomous System (AS) Numbers: An Autonomous System is a collection of IP routing prefixes under a single administrative control. AS numbers can be 16-bit (1 to 65535, with 64512 to 65534 reserved for private enterprise use) or 32-bit.
2. eBGP vs. iBGP:
   • External BGP (eBGP): Peering between routers residing in different Autonomous Systems (e.g., Firebox in AS 65001 peering with ISP 1 in AS 174). eBGP routes have an administrative distance of 20.
   • Internal BGP (iBGP): Peering between routers residing in the same Autonomous System (e.g., two Fireboxes or a Firebox and a datacenter edge router both in AS 65001). iBGP routes have an administrative distance of 200.
3. TCP Transport: Unlike OSPF (IP protocol 89) and RIP (UDP 520), BGP establishes reliable, point-to-point peering connections over TCP port 179. BGP peers do not need to be directly connected at Layer 2 if multihop is enabled.
4. Path Attributes & Best Path Selection: BGP does not use a simple metric like hop count or link speed. Instead, it evaluates a sequence of well-defined path attributes to choose the best route:
   • Weight: Cisco/Quagga proprietary local attribute (highest preferred).
   • Local Preference (LOCAL_PREF): Disseminated within an AS to dictate outbound traffic exit points (highest preferred, default 100).
   • AS-Path: The list of autonomous systems a route advertisement has traversed. Shorter AS-Path lists are strictly preferred (also serves as BGP's primary loop-prevention mechanism—if a router sees its own AS in the path, it drops the update).
   • Origin Code: IGP (i) > EGP (e) > Incomplete (?).
   • Multi-Exit Discriminator (MED): Suggested inbound exit point passed to external neighbors (lowest preferred).

RIP (Routing Information Protocol)

RIP is a legacy distance-vector interior gateway protocol. Fireware supports RIPv1 and RIPv2.

Key RIP Operational Mechanics in Fireware:

1. Metric = Hop Count: RIP measures path distance strictly by the number of routers (hops) a packet must traverse. Link bandwidth, delay, and reliability are completely ignored.
2. Hop Count Limit: The maximum valid hop count in RIP is 15. A hop count of 16 is defined as infinity / unreachable. Consequently, RIP cannot be deployed in networks where any path spans more than 15 hops.
3. Periodic Updates & Convergence: RIP routers broadcast (RIPv1: 255.255.255.255) or multicast (RIPv2: 224.0.0.9) their complete routing table every 30 seconds over UDP port 520. This makes RIP slow to converge and consumes unnecessary broadcast bandwidth.
4. Loop Prevention: Employs Split Horizon (never advertising a route back out the interface from which it was learned), Poison Reverse (advertising failed routes with a metric of 16), and hold-down timers.
5. RIPv1 vs. RIPv2: RIPv1 is strictly classful (no subnet mask transmitted, no CIDR/VLSM support). RIPv2 includes the subnet mask in updates, supports CIDR/VLSM, utilizes multicast instead of broadcast, and supports cleartext/MD5 authentication.

---

Operational Verification & Troubleshooting

Validating routing operations and troubleshooting forwarding failures in Fireware involves three primary administrative surfaces:

1. Firebox System Manager (FSM)

In FSM, navigate to the Status Report tab and scroll to the IPv4 Routes section. The Status Report displays the active kernel routing table, including destination networks, netmasks, gateways, interfaces, metrics, and flags:

• U: Route is Up and active.
• G: Route specifies a Gateway (indirect next-hop).
• H: Host route (/32).
• D: Dynamic route installed by the routing engine.

2. Fireware Web UI

Navigate to System Status > Routes to view the live IPv4 and IPv6 routing table. The Web UI categorizes routes by type (Direct, Static, Dynamic) and allows administrators to filter by interface or destination prefix.

3. Fireware Command-Line Interface (CLI)

Connecting to the Firebox CLI over SSH on TCP port 4118, or through the serial console, provides direct access to the dynamic routing engine shell:

• show ip route — Displays the unified Fireware routing table with protocol origin codes (C = Connected, S = Static, O = OSPF, B = BGP, R = RIP, * = selected candidate default).
• show ip ospf neighbor — Displays OSPF neighbor router IDs, interface IP addresses, dead timer countdowns, and state (e.g., FULL/DR, FULL/BDR).
• show ip bgp summary — Displays BGP neighbor peering status, AS numbers, message counters, and prefix counts accepted.