FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 194047


This article describes how FortiGate performs route lookup and selects the outgoing interface.


By design and by default FortiGate performs two routing lookups:
- One on the first packet sent by the originator.
- Another one on the first reply packet coming from the responder.

How does FortiGate decide routes? FortiGate has multiple routing module blocks shown in the below flow diagram.

- First, FortiGate searches its policy routes. View it using the command diagnose firewall proute list. If there is a match in a policy route, and the action is Forward Traffic, FortiGate routes the packet accordingly.
- If the action is Stop Policy Routing, FortiGate goes to the next table, which is the route cache. view that content using the CLI command # diagnose ip rtcache list.
- If there is no match in the policy route, then FortiGate looks for the SD-WAN rules, finds a matching entry lookup, if there is a match, it will forward the packet immediately and stop traversing the routing tables.
- When you configure a static route that references an SD-WAN zone, you don't have to specify a  gateway address because Fortigate retrieves it from the member configuration.

SD-WAN service rules are policy routes that allow routing specific traffic over specific SD-WAN members.
However, regular policy routes have precedence over SD-WAN policy routes.

- Finally, FortiGate searches the forwarding information base (FIB).
The FIB is similar to the routing table generated by multiple routing protocols (main routing table) and is the table used for packet forwarding.
If there’s no match in any of those tables, FortiGate drops the packet because it is unroutable.

To View the main routing table ( get router info routing-table all) and FIB routes are also known as kernel routes ( get router info kernel).
FortiOS 6.4.0 & 6.2.3, SD-WAN policy routes are skipped when the dst-ip for the traffic belongs to a directly connected subnet. 


Related article:

Technical Tip: Multiple default routes where SD-WAN rules are not preferred