Description
This article describes how FortiGate performs route lookup and selects the outgoing interface.
Scope
FortiGate.
Solution
By design and by default FortiGate performs two routing lookups for any session:
- One on the first packet sent by the originator.
- Another one on the first reply packet coming from the responder.
No more route lookups done unless the session is impacted by a routing change. Route information on the session is flushed and new route lookups are performed.
How does FortiGate decide routes? FortiGate has multiple routing module blocks shown in the below flow diagram.
- FortiGate searches its policy routes. View it using the command diagnose firewall proute list. If there is a match in a policy route, and the action is Forward Traffic, FortiGate routes the packet accordingly.
- If the action is Stop Policy Routing, FortiGate goes to the next table, which is the route cache. view that content using the CLI command # diagnose ip rtcache list.
- If there is no match in the policy route, then FortiGate looks for the SD-WAN rules, finds a matching entry lookup, if there is a match, it will forward the packet immediately and stop traversing the routing tables.
- When configuring a static route that references an SD-WAN zone, you don't have to specify a gateway address because Fortigate retrieves it from the member configuration.
Note.
SD-WAN service rules are policy routes that allow routing specific traffic over specific SD-WAN members.
However, regular policy routes have precedence over SD-WAN policy routes.
- FortiGate searches the forwarding information base (FIB).
The FIB is similar to the routing table generated by multiple routing protocols (main routing table) and is the table used for packet forwarding.
If there’s no match in any of those tables, FortiGate drops the packet because it is unroutable.
To View the main routing table ( get router info routing-table all) and FIB routes are also known as kernel routes ( get router info kernel).
Note.
FortiOS 6.4.0 and 6.2.3, SD-WAN policy routes are skipped when the dst-ip for the traffic belongs to a directly connected subnet. FortiGate Kernel version 3.6 onward have removed the command to view the route cache, diagnose ip rtcache list. To check the Linux version, the command fnsysctl cat /proc/version can be used.
FortiOS 6.4.0 and 6.2.3, SD-WAN policy routes are skipped when the dst-ip for the traffic belongs to a directly connected subnet. FortiGate Kernel version 3.6 onward have removed the command to view the route cache, diagnose ip rtcache list. To check the Linux version, the command fnsysctl cat /proc/version can be used.
Related articles:
Technical Tip: Multiple default routes where SD-WAN rules are not preferred
Troubleshooting Tip: Route cache is removed from FortiGates running new kernel version
