Distance & Priority in Static Routing

[SNino]

I am a bit confused with having both and administrative distance and a priority while adding a static router to Fortigate.

The thing is AD is well known and am pretty aware of how it works and different administrative distance for different routing protocol; however I am a little bit confused when it comes to the "Priority" 

I do understand that if two routes had the same AD but different priority; the lowest priority will be chosen.. if all equal then ECMP applies.. however I have the following questions: 

- What if two routes had different AD & Different priority; which route will be preferred? 

- What would be an actual implementation for Priority as long as I can control the preference based on AD? 

And any other information, use cases.. etc

Thank You =)

[emnoc]

Let's tackle the 1st

- What if two routes had different AD & Different priority; which route will be preferred?

the lower AD value is use in the above and that would be the route seen in the RIB

- What would be an actual implementation for Priority as long as I can control the preference based on AD? /QUOTE]

A   blackhole route for ipsec

 A  3g dialup modem backup route

etc...

Read this KB that   FTNT has out it explain exactaly what/how/and some whys.

http://kb.fortinet.com/kb/viewContent.do?externalId=FD32103

Ken

[SNino]

Well that's makes the first successful use case; is to still have it in the Routing-Table and accepting egress traffic on it; I assume this would be very useful in the case of RPF.. the egress traffic won't be blocked by RPF

However nothing is mentioned about having two routes with different Distance AND Priority, I assume no use cases for such a setup? 

Many thanks emnoc ! 

[ede_pfau]

@SNino: one use case for having 2 default routes with different priorities would be having 2 ISPs, one primary and one backup, on a remote location.

You want to only use the primary ISP for regular outbound traffic, e.g. because it's not volume-limited. The backup line could be costly if used extensively in regard to traffic volume.

Now, from HQ you want to monitor the availability of the backup line. So you ping it. Without the second default route, incoming ICMP traffic would be discarded by RPF. So you install a second default route with same distance (so both routes appear in the Routing table) but higher 'priority'. In FortiOS, 'priority' evaluates to 'cost'.

---

Different distance but same priority is no problem: priority is only taken into account if there are at least 2 routes with the same distance.

---

@emnoc: using blackhole routes for RFC1918 networks to enable fast recovery of IPsec tunnels is perfect. Only, you would not use same distance, different priority, as now you would see 2 routes in the Routing table. It would lose it's primary function to show you at one glance which route the traffic is following.

I always configure the blackhole route with distance=254. This makes sure no other (intended) route would be 'shadowed' by it. The priority parameter is not looked at at all.

[SNino]

Much appreciated! 

Makes complete sense now, so basically Priority is not taken into consideration unless AD is equal; and the use for RPF makes complete sense in addition in ingress load balancing.. which is also useful as most of the times Upload is less utilized than the download.. 

So basically different priority different AD is useless; as the lower AD is always preferred.. 

[emnoc]

Blackhole routes is or has been   FTNT BCP for ipsec-tunnels configuration, also it keeps RFC address from leaking out to the internet via the default-wan with  AD  value of 20

The default AD value  is 10 , you can do 254 but it's not required, just make it a higher value than 10.

Ken