Technical Tip: How to display Kernel route

This article describes how to display the Kernel routing table of FortiGate.

From CLI:

get router info kernel

Sample output:

get router info kernel

tab=255 vf=0 scope=253 type=3 proto=2 prio=0 0.0.0.0/0.0.0.0/0->10.47.0.0/32 pref=10.47.1.42 gwy=0.0.0.0 dev=3(port1)

tab=255 vf=0 scope=254 type=2 proto=2 prio=0 0.0.0.0/0.0.0.0/0->10.47.1.42/32 pref=10.47.1.42 gwy=0.0.0.0 dev=3(port1)

tab=255 vf=0 scope=253 type=3 proto=2 prio=0 0.0.0.0/0.0.0.0/0->10.47.3.255/32 pref=10.47.1.42 gwy=0.0.0.0 dev=3(port1)

tab=255 vf=0 scope=253 type=3 proto=2 prio=0 0.0.0.0/0.0.0.0/0->10.115.0.0/32 pref=10.115.1.42 gwy=0.0.0.0 dev=4(port2)

tab=255 vf=0 scope=254 type=2 proto=2 prio=0 0.0.0.0/0.0.0.0/0->10.115.1.42/32 pref=10.115.1.42 gwy=0.0.0.0 dev=4(port2)

tab=255 vf=0 scope=253 type=3 proto=2 prio=0 0.0.0.0/0.0.0.0/0->10.115.3.255/32 pref=10.115.1.42 gwy=0.0.0.0 dev=4(port2)

tab=255 vf=0 scope=253 type=3 proto=2 prio=0 0.0.0.0/0.0.0.0/0->127.0.0.0/32 pref=127.0.0.1 gwy=0.0.0.0 dev=13(root)

tab=255 vf=0 scope=254 type=2 proto=2 prio=0 0.0.0.0/0.0.0.0/0->127.0.0.0/8 pref=127.0.0.1 gwy=0.0.0.0 dev=13(root)

tab=255 vf=0 scope=254 type=2 proto=2 prio=0 0.0.0.0/0.0.0.0/0->127.0.0.1/32 pref=127.0.0.1 gwy=0.0.0.0 dev=13(root)

tab=255 vf=0 scope=253 type=3 proto=2 prio=0 0.0.0.0/0.0.0.0/0->127.255.255.255/32 pref=127.0.0.1 gwy=0.0.0.0 dev=13(root)

tab=255 vf=0 scope=253 type=3 proto=2 prio=0 0.0.0.0/0.0.0.0/0->169.254.1.0/32 pref=169.254.1.1 gwy=0.0.0.0 dev=15(fortilink)

tab=255 vf=0 scope=254 type=2 proto=2 prio=0 0.0.0.0/0.0.0.0/0->169.254.1.1/32 pref=169.254.1.1 gwy=0.0.0.0 dev=15(fortilink)

tab=255 vf=0 scope=253 type=3 proto=2 prio=0 0.0.0.0/0.0.0.0/0->169.254.1.255/32 pref=169.254.1.1 gwy=0.0.0.0 dev=15(fortilink)

tab=254 vf=0 scope=0 type=1 proto=11 prio=0 0.0.0.0/0.0.0.0/0->0.0.0.0/0 pref=0.0.0.0 gwy=10.47.3.254 dev=3(port1)

tab=254 vf=0 scope=253 type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/0->10.47.0.0/22 pref=10.47.1.42 gwy=0.0.0.0 dev=3(port1)

tab=254 vf=0 scope=253 type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/0->10.115.0.0/22 pref=10.115.1.42 gwy=0.0.0.0 dev=4(port2)

tab=254 vf=0 scope=253 type=1 proto=2 prio=0 0.0.0.0/0.0.0.0/0->169.254.1.0/24 pref=169.254.1.1 gwy=0.0.0.0 dev=15(fortilink)

The output can also be filtered using a grep command:

get router info kernel | grep 10.47.1.42

tab=255 vf=0 scope=254 type=2 proto=2 prio=0 0.0.0.0/0.0.0.0/0->10.47.1.42/32 pref=10.47.1.42 gwy=0.0.0.0 dev=3(port1)

To filter the kernel routes based on the proto ID:

get router info kernel 2 <---

get router info kernel 11  <---

This is important to check if a specific route is installed in kernel routes.

The kernel routing table entries are:

The type entries are:

The proto entries are:

Sample dev=3:

diagnose netlink interface list | grep index=3

if=port1 family=00 type=1 index=3 mtu=1500 link=0 master=0

In the context of Kernel routing tables, the 'scope' value indicates the reachability of a route.

• A 'scope' value of 0 indicates a global route.
  This means the route is valid for the entire network and can be used to route traffic beyond the local network segment.
• A 'scope' value of 253 typically represents a site-local route.
  This means the route is intended for use within a specific site or organisation and is not meant to be used for routing traffic outside of that site.
• A 'scope' value of 254 typically represents a link-local route.
  This means the route is only valid within the local network segment and is not intended for routing traffic beyond the local link.
• A 'scope' value of 255 typically represents a host route.
  This means the route is specific to a single host or device, and it is used to direct traffic to that particular host.
  
  
  
  

Notes:

• VDOM consideration: If VDOMs are enabled, run routing commands inside the correct VDOM context (not global), otherwise the output may be misleading.
  
  

• HA consideration (Active-Passive): In HA clusters, the kernel routing table (FIB) should be consistent across members. Use it to validate forwarding consistency during failover troubleshooting.
  
  

• If a route exists in the routing-table database but not in the kernel table, it may not be resolved/installed for forwarding (inactive/not selected).
  
  

get router info kernel

• This command shows the Forwarding Information Base (FIB): resolved routes actually used by the kernel to forward packets.
  
  

get router info routing-table database

• This command shows the routing database (RIB), including inactive routes.