FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
rishab444
Staff
Staff
Article Id 373745
Description This article assists in scenarios, where the design is to use static route as a backup of an existing dynamic route and Administrative distance is used to influence Route Selection. Some common example are backup MPLS links or physical backdoor to the device.
Scope FortiGate.
Solution
  • The fundamental attribute differentiating all type of routes is Administrative Distance.
  • By default the Static Route has an AD of 10, OSPF - 110, EBGP - 20 and IBGP - 200.
  • The Lower Administrative distance is preferred which makes the Static Route to take precedence over these dynamic routes.

 

For instance, below is the output of the routing database where the Static route is selected as the best route and is added to the Forwarding Information Database(FIB):

dbed.png

 

  • There could be a scenario where the design is to prioritize the Dynamic routing for a single subnet or IP.
  • The issue arises when the Static route is over an SD-WAN interface, the GUI loses the option as soon as this interface is selected.

Before:

1ed.png

 

After:

2ed.png

 

  • Although the GUI is missing this option, it is still possible to use the CLI to change. By default, a static route or the default route outgoing through an SD-WAN zone have an administrative distance of 1


config router static
    edit <Static Route ID>
        set dst <IP Subnet>
        set distance <Administrative Distance>
        set sdwan-zone "<SDWAN Zone>"
    next
end

  • After changing the distance, it can be observed that the Dynamic BGP route takes precedence and is added to the Forwarding Information Database(FIB):

    meth.PNG

     
    outed.png