| Description | This article describes how to perform routing lookup on FortiGate from GUI and CLI and also covers the difference between the lookup on the GUI and CLI. |
| Scope |
FortiGate - Access to the Routing Widget. |
| Solution |
On version 6.0.x, 6.2.x or below: Go to Monitor -> Routing Monitor.
On version 6.4.x and above: Go to Dashboard -> Network -> Routing.
Related link:
Why use the Routing Lookup in the Routing Widget instead of CLI: The CLI version of this is this command ' get router info routing-table <ip>'. The output of this command will only show the routes taken by the FIB. It will not show whether the traffic will get routed through Policy Routes or not. The advantage of using the Routing Lookup on the GUI is that if the route matches a Policy Route or SDWAN Rule, it will show that it gets matched. Furthermore, it is possible to specify Source IP and/or Source Interface on the Routing Lookup Widget. This is beneficial if we want to see how traffic from a specific VLAN, source IP etc is getting routed.
Local-Out Traffic aka Fortigate Self-Originating Traffic.
1) After opening the widget, select Route Lookup. As visible here, only the Destination IP field is mandatory to be filled up.
2) If only the Destination IP is entered, the result will show how FortiGate would route the traffic by Default. This is important especially when multiple WAN links or SD-WAN are used. The default route shown here also tells that this is the route that FortiGuard services will use, DNS, FortiCloud logging and etc.
This is an example where Policy Routes/SD-WAN Rules are taken instead of the FIB. In Fortigate's Routing Precedence, Policy Routes and SD-WAN Rules are similar. Policy Routes take higher precedence than SD-WAN Rules.
1) SD-WAN Rule is configured here.
2) Route Lookup - 8.8.8.8.
3) Policy Route is chosen.
4) When referring to the FIB from CLI, it is showing that traffic to 8.8.8.8 will usually take port1 first.
This is evident when both existing SDWAN Rules had been Disabled:
More information about Fortigate's Route Lookup Process: |
