FortiGate Administration Guide - FirewallShop.com

Routing concepts
Router Static
The order of entries in the Static Route list typically mirrors the sequence of static
routes in the routing table when all static routes are configured through the webbased
manager. However, because you can specify the sequence number of a
static route when you add the route through the CLI, the sequence number of a
route may not always match its entry number in the Static Route list. Sequence
numbers can be specified for static routes through the CLI only. In summary, if a
route in the routing table has a lower sequence number than another route to the
same destination, the FortiGate unit will choose the route with the lower sequence
number before choosing the other route. Because you can use the CLI to specify
which sequence numbers or priority field settings to use when defining static
routes, routes to the same destination can be prioritized according to their
sequence numbers and priority field settings. For a static route to be the preferred
route, you must create the route using the config router static CLI
command and specify a low sequence number or low priority for the route.
Equal Cost Multipath (ECMP) Routes
Blackhole Routing
Note: You can display the sequence numbers of static routes in the routing table through
the CLI: type config router static, and then type get. The sequence number of a
route is equivalent to the edit value that one enters when defining a
static route through the CLI. For more information, see config router static in the
FortiGate CLI Reference.
When there is more than one route to the same destination, it can be confusing
which route or routes will be installed and used. This is based on distance and
priority, as explained earlier. If the distance of both routes is the same and both
priorities are the same, then they are an Equal Cost Multipath (ECMP) route. If
you have load balancing enabled with ECMP routes, then different sessions will
use different routes to the same address to load balance traffic.
Blackhole routing is a route that drops all traffic sent to it. It is very much like
/dev/null in Linux programming.
Blackhole routing is used to dispose of packets instead of responding to
suspicious inquiries. This provides added security since the originator will not
discover any information from the target system.
Blackhole routing can also be used to limit traffic on a subnet. If some addresses
are not in use, traffic to those addresses (traffic which may be valid or malicious)
can be directed to a blackhole for added security and lowering traffic on the
subnet.
The loopback interface was added to enable easier configuration of blackhole
routing. It is a virtual interface that does not forward traffic. It can only be
configured from the CLI, the same way as a normal interface, but it has fewer
parameters to configure and all traffic sent to it stops there. It does not suffer from
hardware connection or link status problems, so it is always available. This can be
useful for other dynamic routing roles. Once configured, a loopback interface can
be used in firewall policies, routing, and other places that refer to interfaces. For
more information see the system chapter of the FortiGate CLI Reference.
FortiGate Version 3.0 MR5 Administration Guide
234 01-30005-0203-20070830