FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Description This article describes how FortiGate performs route lookup and select the outgoing interface.
Solution By design and by default FortiGate performs two routing lookups: - One on the first packet sent by the originator. - Another one on the first reply packet coming from the responder.
How does FortiGate decide routes? FortiGate has multiple routing module blocks shown in the below flow diagram.
- First, FortiGate searches its policy routes. View it using the command # diagnose firewall proute list. If there is a match in a policy route, and the action is Forward Traffic, FortiGate routes the packet accordingly. - If the action is Stop Policy Routing, FortiGate goes to the next table, which is the route cache. view that content using the CLI command # diagnose ip rtcache list. - If there is no match in the policy route, then FortiGate looks for the SD-WAN rules, finds a matching entry lookup, if there is a match, it will forward the packet immediately and stop traversing the routing tables.
Note. SD-WAN service rules are policy routes which allow routeing specific traffic over specific SD-WAN members.
However, regular policy routes have precedence over SD-WAN policy routes.
- Finally, FortiGate searches the forwarding information base (FIB).
The FIB is similar to the routing table generated by multiple routing protocols (main routing table) and is the table used for packet forwarding.
If there’s no match in any of those tables, FortiGate drops the packet because it is unroutable.
To View main routing table (# get router info routing-table all) and FIB routes are also known as kernel routes (# get router info kernel).
Note. FortiOS 6.4.0 & 6.2.3, SD-WAN policy routes are skipped when the dst-ip for the traffic belongs to a directly connected subnet.