Advanced routing and multicast solve the problem of getting data from one place to another across huge, complicated networks without wasting resources or time. For the NSE7 exam, you need to know how routers choose paths, how they share that information with each other, and how one stream of data can reach many devices at once. This chapter breaks down the specific protocols—BGP, OSPF, and multicast—that make this possible.
Jump to a section
A simple way to picture Advanced Routing and Multicast
9 courier vans depart from a central sorting office every hour, each headed to a different suburb. The sorting office manager knows every street in every suburb, but a single van cannot carry every package to every door. Instead, the manager uses a master route map that shows the fastest path to each suburb's local depot, and those depots handle the final delivery. This is exactly how advanced routing works on a computer network: the central router (the sorting office) holds a routing table (the master map) that tells it the best path to send data to any destination network (the suburb).
Now imagine that a courier van needs to deliver a single important letter to 50 different houses in the same street. It would be silly for the van to drive back and forth 50 times. Instead, the manager tells the van to drive down the street once, and the van honks its horn while someone at each house listens for their specific address. That is multicast: one stream of data sent once, and only the devices that have subscribed to that stream receive it. In a network, this saves huge amounts of bandwidth because the data is not duplicated for each receiver.
When a road is blocked, the manager instantly recalculates the fastest alternative route using information from other couriers on the road. Routers do the same thing with dynamic routing protocols. They share information with neighbouring routers to adapt when a link fails. BGP is like a courier service that coordinates between different countries, each with their own internal postal systems, to deliver packages across borders. It is the protocol that makes the internet work by connecting thousands of separate networks together.
Routing is the process of moving data packets (small chunks of information) from a source device to a destination device across a network. A router is a specialised computer that connects different networks together. Each router keeps a routing table, which is like a map of all the networks it knows about and the best path to reach each one.
There are two main ways routers learn these paths: static routing and dynamic routing. Static routing means a network administrator manually types the routes into the router. This is simple and secure but does not adapt when the network changes. Dynamic routing uses protocols (rules) that let routers automatically share information with each other. If a link goes down, the routers update their tables and find a new path without human help. For NSE7, you will focus on two dynamic routing protocols: OSPF (Open Shortest Path First) and BGP (Border Gateway Protocol).
OSPF is an Interior Gateway Protocol (IGP). This means it is designed for use inside a single organisation, like a company with offices in one city. OSPF works by having each router announce the networks it is directly connected to. All routers in the OSPF area build a complete picture (a topology map) of the entire network. They use Dijkstra's algorithm, a mathematical formula, to calculate the shortest path to every destination. OSPF is fast and efficient, but it can become complex in very large networks with hundreds of routers.
BGP is an Exterior Gateway Protocol (EGP). It is used to connect different organisations, like connecting a company's network to the internet. BGP is the protocol that runs the entire internet. Instead of calculating the shortest path, BGP makes routing decisions based on policies. These policies determine which paths are preferred based on business rules, such as which internet service provider (ISP) is cheaper or more reliable. BGP is much more complex than OSPF because it must handle thousands of routes and enforce administrative rules.
Multicast is a method of sending data to multiple receivers at the same time using a single stream. This is different from unicast (one-to-one) and broadcast (one-to-all). In multicast, a source sends one copy of the data to a special group address. Devices that want to receive that data join the group. Routers then use a protocol called PIM (Protocol Independent Multicast) to build a distribution tree that efficiently delivers the data to all group members without sending duplicates. Common uses include live video streaming, online gaming, and software updates to many devices at once.
Combining these concepts, a real network might use OSPF inside a company's headquarters, BGP to connect the company to its internet provider, and multicast to stream a live event to employees across different floors. The NSE7 exam tests your ability to configure and troubleshoot these protocols on Fortinet devices, especially FortiGate firewalls, which can perform all three functions. You must understand when to use each protocol and how they interact.
Enable routing on the FortiGate
Log into the FortiGate CLI and enter config router ospf to start OSPF configuration. You must first enable OSPF globally with 'set router-id <IP_address>'. The router ID uniquely identifies the router in OSPF.
Define OSPF areas and networks
Use 'config area' to create areas, such as area 0.0.0.0 for the backbone. Then use 'config network' to assign which interfaces participate in OSPF and which area they belong to. For example, 'edit 10.10.1.0/24' sets that network into area 0.
Configure BGP peering
Use 'config router bgp' and set the local AS number. Then add a neighbour with 'config neighbor' and specify the neighbour's IP address and remote AS. For eBGP, the remote AS must be different from your local AS. For iBGP, it must match.
Set up route redistribution
To share OSPF routes into BGP, use 'config router bgp' and 'config redistribute ospf'. Set status to enable. Optionally apply a route map to filter which routes are shared. This prevents leaking private routes to the internet.
Enable multicast and configure PIM
Use 'config router multicast' and set 'enable'. Then for each interface that will use multicast, use 'config interface' and enable PIM mode (sparse or dense). Define a Rendezvous Point (RP) for sparse mode. Finally, create a multicast policy in the firewall to allow multicast traffic.
An IT professional working for a medium-sized company with five branch offices and a data centre would use advanced routing every day. Suppose a user in the London office needs to access a server in the Singapore data centre. The network engineer must ensure that traffic flows along the fastest and most reliable path. If the direct link between London and Singapore goes down, traffic must automatically reroute through the Paris office without anyone noticing.
To achieve this, the engineer configures OSPF on all routers inside the company network. Each router advertises its local networks. For example, the London router advertises the 10.10.1.0/24 network, and the Singapore router advertises the 10.10.2.0/24 network. OSPF calculates the best path and updates automatically when a link fails. The engineer must also consider security. OSPF can authenticate routing updates to ensure that no rogue router can inject false routes.
For internet connectivity, the company has two internet service providers (ISPs) for redundancy. The engineer uses BGP to connect the company's network (an Autonomous System, or AS) to both ISPs. BGP allows the engineer to announce the company's public IP blocks to both ISPs. If one ISP goes down, BGP automatically switches traffic to the other ISP. The engineer also uses BGP attributes like Local Preference and AS Path to control which ISP is preferred for outgoing traffic.
When the company holds a global town hall meeting streamed live from headquarters, multicast becomes essential. The engineer configures PIM on all routers to create a multicast distribution tree. The video server sends one stream to a multicast group address, and routers forward it to offices that have users subscribed to the stream. Without multicast, the server would have to send hundreds of separate unicast streams, overwhelming both the server and the network bandwidth.
The practical actions an engineer takes include:
Checking routing tables with commands like 'get router info routing-table' on a FortiGate
Configuring OSPF areas and redistributing routes
Setting up BGP peer relationships and applying route maps for policy control
Enabling multicast and configuring PIM on interfaces
Troubleshooting by looking at logs, pinging remote hosts, and verifying BGP peering state
Using tools like traceroute to see the actual path traffic takes
In summary, an IT professional uses these protocols to build a network that is resilient, efficient, and scalable. A mistake in a BGP configuration can take down internet access for an entire company, so precision is critical.
The NSE7 Advanced Security exam focuses heavily on the practical configuration and troubleshooting of BGP and OSPF on FortiGate devices. You will see multiple-choice, drag-and-drop, and simulation questions that test your ability to choose the correct command or setting. The exam loves to present scenarios with failing links or misconfigured peers and ask what the symptom is or how to fix it.
Key concepts the exam tests:
Differences between iBGP (internal BGP) and eBGP (external BGP): eBGP peers are typically directly connected, iBGP peers can be multiple hops away and require an IGP (like OSPF) for next-hop reachability
BGP attributes: especially AS Path, Local Preference, and MED (Multi-Exit Discriminator). Know which attribute is most important and how they influence route selection
OSPF areas and LSA types: understand backbone area (area 0), regular areas, and stub areas. LSA (Link State Advertisement) types 1 through 5 define how routes are shared
Multicast: PIM sparse mode vs dense mode. Sparse mode requires a Rendezvous Point (RP). FortiGate's multicast routing configuration through policies
Traps the exam sets:
They will give you a BGP configuration with a wrong AS number on one side. The symptom is the BGP session never reaches the Established state. The correct answer is to fix the AS number
They will show an OSPF configuration where two routers have mismatched area IDs. The symptom is they become neighbours but do not exchange routes properly
They will ask about route redistribution. Redistributing OSPF into BGP or vice versa can cause routing loops if not done carefully. The exam tests whether you know to use route maps to filter redistributed routes
For multicast, they often test that you must enable multicast on the FortiGate interface and configure a multicast policy, not just enable PIM
Definitions to memorise:
Autonomous System (AS): a collection of networks under a single administrative control
Route Map: a set of rules that can match and modify routing information
Neighbour: another router with which your router shares routing information
Prefix: a network address and its subnet mask, like 192.168.1.0/24
Expect at least three questions on BGP attributes and at least two on OSPF areas. Multicast typically appears in one or two questions. Study the command line interface (CLI) output for 'get router info bgp summary' and 'get router info ospf neighbor' because the exam will test your ability to read those outputs. The correct answer pattern often involves identifying whether a problem is a configuration error (like missing a peer) or a connectivity issue (like a firewall blocking port 179 for BGP).
OSPF is an Interior Gateway Protocol that uses Dijkstra's algorithm to calculate the shortest path based on link cost.
BGP is an Exterior Gateway Protocol that uses policies and attributes like AS Path and Local Preference to select routes between different organisations.
Multicast sends one copy of data to a group address, and only devices that are subscribed to the group receive it, saving bandwidth.
BGP peers must have matching AS numbers for eBGP sessions and the same AS for iBGP sessions, and they communicate via TCP port 179.
OSPF requires all routers in the same area to have identical link-state databases to ensure loop-free routing.
Route maps are essential for controlling route redistribution between different routing protocols and must be applied to prevent routing loops.
These come up on the exam all the time. Here's how to tell them apart.
OSPF (Open Shortest Path First)
Used inside a single organisation (IGP)
Calculates shortest path based on link cost
Uses IP protocol 89, no TCP or UDP
BGP (Border Gateway Protocol)
Used between different organisations (EGP)
Selects path based on administrative policies
Uses TCP port 179 for reliable delivery
Static Routing
Routes are manually configured by an administrator
Does not adapt to network changes automatically
Simple but not scalable for large networks
Dynamic Routing (OSPF/BGP)
Routes are learned automatically from other routers
Adapts immediately when links fail or change
Scalable and suitable for complex networks
Multicast (PIM Sparse Mode)
Data is sent to a group address, receivers must subscribe
Saves bandwidth by sending only one copy
Uses Rendezvous Point (RP) to manage group membership
Broadcast
Data is sent to all devices on a network segment
Wastes bandwidth because all devices receive it
No subscription required; all devices must process the data
Mistake
BGP always chooses the shortest path to a destination, just like OSPF.
Correct
BGP chooses the path based on administrative policies, not necessarily the shortest path. Attributes like Local Preference and AS Path can override physical distance.
People assume all routing protocols work the same way because they all choose paths. But BGP is designed for business decisions, not pure speed.
Mistake
If two OSPF routers can ping each other, they will automatically become neighbours and exchange routes.
Correct
OSPF neighbours require matching parameters like area ID, authentication, and network type. Ping shows IP connectivity but does not guarantee OSPF will form a neighbour relationship.
It is easy to think that basic connectivity is enough, but routing protocols have their own handshake and configuration requirements.
Mistake
Multicast is the same as broadcast because both send data to many devices at once.
Correct
Broadcast sends data to all devices on a network, whether they want it or not. Multicast only sends to devices that have explicitly subscribed to the group.
Both involve multiple receivers, but the mechanism and efficiency are completely different. Beginners often confuse the two because of the similar outcome.
Mistake
You only need to configure BGP on the router that connects to the internet; internal routers do not need any BGP configuration.
Correct
Internal routers often need iBGP to propagate external routes inside the network. If internal routers do not have iBGP, they will not know how to reach external destinations.
People think BGP is only for the edge, but internal routers must learn external routes through BGP or redistribution. This is a common oversight.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Unicast sends data from one sender to one receiver. Broadcast sends data to all devices on a network. Multicast sends data to a specific group of devices that have subscribed to receive it.
BGP uses TCP to ensure reliable, ordered delivery of routing information between peers. TCP provides error checking and retransmission, which is critical for accurate routing tables.
Yes, this is common. OSPF handles routing inside your organisation, and BGP connects your network to the internet or other organisations. They can run together and share routes through redistribution.
They will not become full neighbours. OSPF requires matching area IDs on directly connected interfaces. They may become neighbours in a different area, but they will not exchange routes correctly.
A route map is a set of rules that can match specific routes and modify their attributes or decide whether to permit or deny them. It is used for filtering and policy control, such as setting Local Preference for preferred paths.
Multicast on the public internet is very limited because most ISPs do not support it. It is mainly used inside private networks or dedicated multicast-enabled service providers.
You've finished Advanced Routing and Multicast. Continue through the NSE7 study guide to build a complete picture of the exam.
Done with this chapter?