Routing Concepts and Troubleshooting Quiz

RPF Check

• The default mode for RPF check is feasible path mode.

Feasible Path Mode

• In feasible path mode, a packet is accepted as long as there is one active route to the source IP through the incoming interface.
• Feasible path mode was formerly known as "asymmetric routing".
• The packet does not need to take the best route in feasible path mode.

Packet Acceptance

• The packet from 10.4.0.1 to 10.1.0.1 gets accepted.
• The packet from 172.16.1.1 to 10.1.0.1 gets accepted.

Route Information

• There is no active route to the IP address 172.16.1.1 through port3.
• The destination IP of the packet that is accepted is 10.1.0.1.
• The destination IP of the packet that is not accepted is not specified.

Routing

• The default route is used for routing packets when there is no specific route.
• When the action in a policy route is Stop Policy Routing, FortiGate goes to the Kernel routing table.
• The purpose of the Forwarding Information Base (FIB) is to facilitate routing decisions.
• In a FortiGate high availability (H-A) cluster, the secondary FortiGate has a dedicated routing table.
• If there is no match in any of the routing tables, FortiGate uses the default route.
• The first criteria used by FortiGate to select a route when there are multiple routes to a destination is the longest prefix match.
• FortiGate uses the lowest metric as the tiebreaker for dynamic routes when there are multiple routes with the same prefix length.
• FortiGate uses the lowest priority as the tiebreaker for static routes.
• Equal cost multipath (ECMP) is used for load balancing and redundancy.

Route Addition

• FortiGate adds a static route to the routing table when the route is configured manually.

RPF Protection

• The reverse path forwarding (RPF) check protects against spoofing attacks.

Routing Table Lookup

• FortiGate performs routing table lookup only once for any session.
• The route information in the session table is updated after a routing change.
• FortiGate usually performs one routing lookup for a traffic session.
• FortiGate performs additional routing table lookups when the routing table changes or the session is re-established.

Route Decision

• FortiGate decides routes based on the routing table and policy routes.

Policy Routes

• The command to view FortiGate's policy routes is "diag debug appl cs-route".

Routing Modules

• FortiGate has two routing modules: the kernel routing table and the FIB.

Routing Information

• After performing routing lookups for a session, FortiGate stores the routing information in the session table.
• The route information in the session table is updated after a routing change.
• FortiGate is a stateful device.