I am a bit confused with having both and administrative distance and a priority while adding a static router to Fortigate.
The thing is AD is well known and am pretty aware of how it works and different administrative distance for different routing protocol; however I am a little bit confused when it comes to the "Priority"
I do understand that if two routes had the same AD but different priority; the lowest priority will be chosen.. if all equal then ECMP applies.. however I have the following questions:
- What if two routes had different AD & Different priority; which route will be preferred?
- What would be an actual implementation for Priority as long as I can control the preference based on AD?
Well that's makes the first successful use case; is to still have it in the Routing-Table and accepting egress traffic on it; I assume this would be very useful in the case of RPF.. the egress traffic won't be blocked by RPF
However nothing is mentioned about having two routes with different Distance AND Priority, I assume no use cases for such a setup?
@SNino: one use case for having 2 default routes with different priorities would be having 2 ISPs, one primary and one backup, on a remote location.
You want to only use the primary ISP for regular outbound traffic, e.g. because it's not volume-limited. The backup line could be costly if used extensively in regard to traffic volume.
Now, from HQ you want to monitor the availability of the backup line. So you ping it. Without the second default route, incoming ICMP traffic would be discarded by RPF. So you install a second default route with same distance (so both routes appear in the Routing table) but higher 'priority'. In FortiOS, 'priority' evaluates to 'cost'.
Different distance but same priority is no problem: priority is only taken into account if there are at least 2 routes with the same distance.
@emnoc: using blackhole routes for RFC1918 networks to enable fast recovery of IPsec tunnels is perfect. Only, you would not use same distance, different priority, as now you would see 2 routes in the Routing table. It would lose it's primary function to show you at one glance which route the traffic is following.
I always configure the blackhole route with distance=254. This makes sure no other (intended) route would be 'shadowed' by it. The priority parameter is not looked at at all.
Makes complete sense now, so basically Priority is not taken into consideration unless AD is equal; and the use for RPF makes complete sense in addition in ingress load balancing.. which is also useful as most of the times Upload is less utilized than the download..
So basically different priority different AD is useless; as the lower AD is always preferred..
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.