After introducing some of the basic concepts related to the network interfaces, it is now necessary to examine the routing of data packets inside a FortiGate. Routing is the process of moving data from one network to another. The easiest method to handle routing is to create static routes that define the next step (gateway or hop) towards a given network. A gateway is a networking device that acts as an entrance to another network. It could be directly connected to the remote network or may know a route to the required network and be able to forward the packets to another gateway.
Usually we have two kinds of networks:
Static routes can be configured by navigating to the Router | Static | Static Route menu. In the following screenshot we can see a default route that will send all the traffic to networks with no specific route to the default gateway (192.168.1.1 in our example):
Two parameters require additional explanation: Distance and Priority.
Talking about static routing, distance is typically used as an indicator of the quality of a connection. A connection of 100 Mbps will have a distance lower than an ISDN connection. So, if you have two routes to the same destination but with different costs, the lower cost route will be used. The distance can be a value between 0 and 255.
Note
In case we will also use dynamic routing protocols, the dynamically received routes will have their own default administrative distance. In this scenario, not all values will be available. This topic will be addressed in the section Dynamic Routing.
If we have two connections of equal quality (equal distance) but we want to use one of the two, we can adjust the "priority" parameter. The route with the lower priority is considered preferable and will be used. Priority can be a value between 0 and 4,294,967,295.
The workload is automatically balanced on two or more routes having equal distance and priority.
Note
One of the limitations of static routing is the inability to detect network changes and network failures. For example, a backup route (inserted with higher cost) will never be used, unless the link status of the physical interface with the lower cost route is in a status of "link down". Even for load balancing, if the interfaces are seen as "link up", the packets are sent to both, even if the gateway of one of the two is not reachable. We will talk about interface monitoring in the section FortiGate Cluster Protocol (FGCP) in Chapter 4, High Availability.