# Routing Basics and Static Routes

> Chapter 3 of the Courseiva FORTINET-NSE4 curriculum — https://courseiva.com/learn/fortinet-nse4/routing-basics-and-static-routes

**Official objective:** 2.1 — Configure static routes, administrative distances, and understand routing table concepts for FortiGate.

## Introduction

Exam objective 2.1 requires you to configure static routes, understand administrative distances, and read a routing table on a FortiGate firewall. This chapter solves a simple but critical problem: how does a network device know where to send data when it leaves the device? Without understanding routes, a firewall is just an expensive paperweight — it cannot forward a single packet because it has no map of the network.

This is the chapter that turns an abstract diagram into something you can actually configure. By the end, you will understand why a route needs both a destination and a next hop, why some routes disappear when a link goes down, and how the firewall chooses between two routes to the same place. Every NSE4 exam candidate who fails this section does so because they cannot explain what the routing table is actually saying — not because they forgot a command.

## The Hotel Mail Clerk Analogy

The front desk mail clerk at a massive convention hotel. This person stands behind a counter in a room full of numbered cubbies, one for each guest room. Their job is to take every incoming letter or package and decide which cubby it goes into, then get it to the right person.

If a letter arrives with a complete address — room 1024 on the 10th floor — the clerk knows exactly where it goes. That is a static route: a fixed, pre-written instruction that says 'anything for this specific room number goes into this specific cubby.' The clerk does not need to think about it, look at a map, or ask anyone. The instruction is written down in the hotel manual.

Now imagine a letter arrives that just says '10th floor, room near the ice machine.' The clerk cannot deliver that because the instruction is not precise enough. The hotel manual has no entry for vague descriptions. That is what happens when a packet arrives at a router without a matching route — it gets dropped.

Finally, if the manual has two conflicting instructions — one saying 'all 10th floor mail goes to cubby row A' and another saying '10th floor mail goes to cubby row B' — the clerk follows the instruction with the smallest number written next to it. That number is the administrative distance. Smaller number wins, just like a lower priority number wins in the router's routing table.

## Core explanation

At its simplest, routing is the process of moving data from one network to another. A network is any group of devices that can talk to each other directly — like all the computers in one office or all the phones on one home WiFi. When a device wants to send data to a device on a different network, it cannot just shout. It needs a router. The router is a specialised device — or in the case of FortiGate, a function inside the firewall — that knows how to forward data to other networks.

Every router keeps a list of destinations it knows about. That list is called the routing table. Think of it as a directory. Each entry — called a route — tells the router three things: the destination network (where the data wants to go), the next hop (the specific IP address of the next router to hand the data to), and the interface (the physical or virtual port on the router that connects to that next hop). If a packet arrives for a destination that is not in the routing table, the router discards it. It does not guess. It cannot ask for directions. It just drops the packet.

There are two main ways a route gets into the routing table: dynamically and statically. Dynamic routing protocols like OSPF (Open Shortest Path First) let routers automatically discover networks by talking to each other. Static routes are the opposite — you, the administrator, type them in by hand. For the NSE4 exam, you spend most of your time on static routes because FortiGate administrators in real jobs often use static routes for simple networks that do not change frequently.

A static route has three mandatory parts on a FortiGate. The first is the destination. This is the IP address range you want to reach. You write it using CIDR notation — for example, 192.168.2.0/24 means 'all IP addresses from 192.168.2.1 to 192.168.2.254.' The second part is the netmask, which tells the router how many bits of the destination are the network part versus the host part. FortiGate typically asks for the netmask in dotted decimal format, like 255.255.255.0 for a /24. The third part is the gateway, or next hop — the IP address of the router sitting between your FortiGate and the destination network.

When you configure a static route, FortiGate adds it to the routing table with an administrative distance (AD). The AD is a number from 0 to 255 that indicates how trustworthy the route is. Lower numbers are more trustworthy. Static routes on FortiGate default to an AD of 10. Directly connected networks — networks physically plugged into the FortiGate's own interfaces — have an AD of 0. Dynamic routes learned via OSPF have an AD of 110. If the routing table has two routes to the same destination, the route with the lower AD wins. That is how the firewall decides without any confusion.

Why does AD matter? Because you might have two paths to the same network — one fast but expensive, one slow but cheap. You can configure both as static routes. The one with the lower AD is the primary route. If that link goes down, FortiGate automatically switches to the backup route with the higher AD. This is called floating static routing. It is a simple and reliable way to provide redundancy without needing a complicated dynamic protocol.

When a packet arrives at the FortiGate, the firewall checks the destination IP against the routing table. It looks for the most specific match — the route with the longest subnet mask that still includes the destination IP. If there is a tie in specificity, it uses the administrative distance. If there is still a tie (same destination, same AD), it can load-balance across both routes. FortiGate supports equal-cost multi-path (ECMP) routing, which lets you spread traffic across multiple links that have equal priority.

One critical detail for the exam: static routes on FortiGate can also include a device index instead of a gateway IP. When you specify the interface name instead of the next hop IP, the FortiGate assumes the destination is directly reachable on that interface. That is common for point-to-point links where there is only one possible next hop anyway. But in a broadcast network like Ethernet, you must specify the gateway IP. If you forget, the firewall cannot resolve the Layer 2 address (the MAC address) and the route will never work.

Finally, you need to understand the concept of the default route. A default route — written as 0.0.0.0/0 — is a catch-all. It says 'for any destination I do not have a specific route for, send the packet here.' Most networks have a default route pointing to the internet gateway. Without it, the FortiGate would drop any packet destined for a website or cloud service because those IPs are not in the routing table. The default route on FortiGate has an AD of 10 by default. You can change that AD to create a backup default route to a second internet link.

In summary, routing is about giving your firewall a map. Static routes are the hand-drawn paths you put on that map yourself. The routing table is the full map. The administrative distance is the ranking system that tells the firewall which path to trust when two paths exist. Understanding these three concepts — static route configuration, routing table structure, and administrative distance — is the foundation of Objective 2.1.

## Real-world context

Let us walk through a realistic business scenario. You work for a mid-sized company called Northshore Logistics. The head office has a FortiGate 80F firewall that connects to three internal networks and two internet links. The internal networks are: 10.10.10.0/24 (finance), 10.10.20.0/24 (operations), and 10.10.30.0/24 (warehouse). Each network is on a different physical interface of the FortiGate. The two internet links are on port1 (primary fibre) and port2 (backup LTE).

Your first task is to configure static routes on the FortiGate so that traffic can reach the internet. You do not need a route for the internal networks because they are directly connected — FortiGate automatically creates a route for any interface that is up and has an IP address. But for the internet, you need a default route. You log into the FortiGate CLI or GUI and configure: destination 0.0.0.0/0, gateway the ISP's router IP on port1, administrative distance 10. This is the primary internet path.

Now you want a backup. If the fibre goes down, you want traffic to go out through the LTE modem on port2. You create a second default route: destination 0.0.0.0/0, gateway the LTE modem's IP, administrative distance 20. Because 20 is higher than 10, this route is a floating static route. It stays in the routing table in an inactive state until the primary route disappears. When port1 goes down, FortiGate removes the primary route from the routing table and activates the LTE route. Mail keeps flowing.

Next, you need to allow the warehouse network to access a cloud-based inventory system at 203.0.113.0/24. That cloud network is reachable through a VPN tunnel that terminates on a partner router at 198.51.100.1. You add a static route: destination 203.0.113.0/24, gateway 198.51.100.1, interface port3 (the one connected to the partner router). Now any packet from the warehouse destined for 203.0.113.x gets forwarded to the partner router.

What does an IT professional actually do with this day to day? They check the routing table when users complain about connectivity. The command 'get router info routing-table all' on the FortiGate CLI shows every route and its AD. If users cannot reach the internet, you look for the default route. If it is missing, you know the fibre is down or the static route was accidentally deleted. If it is there but traffic still fails, you check the next hop — can the FortiGate ping the ISP router?

When troubleshooting, professionals also check the blackhole concept. A blackhole route is a static route to a specific destination with a gateway of 0.0.0.0 and the 'blackhole' option enabled. This route silently discards traffic for that destination. It is useful when you want to block traffic to a known malicious IP range without creating a firewall policy — the route never reaches a policy because it gets dropped at the routing stage.

Another real task: merging two offices after an acquisition. You have two FortiGates that now need to talk. You add static routes on each firewall pointing to the other's LAN subnets. You also have to adjust the administrative distances on some routes to ensure the old internet links are deprioritised in favour of the new MPLS link. You change the AD on the MPLS static route to 5 (lower than the default 10) so it always wins.

Finally, professionals use static routes to force specific traffic out specific interfaces. This is called policy-based routing if done via policies, but with static routes you can achieve a similar effect by configuring multiple routing tables called virtual routing and forwarding (VRF) instances on FortiGate. That is more advanced, but the core idea is the same: you tell the firewall precisely where to send traffic, and it obeys without question.

## Exam focus

NSE4 tests Objective 2.1 with a mix of multiple-choice, drag-and-drop, and scenario-based questions. The exam expects you to understand routing concepts at a foundational level, not just memorise commands. Here is what they love to ask.

First, they test the administrative distance values directly. You must know the default AD for static routes (10), for directly connected routes (0), for OSPF routes (110), and for routes from other dynamic protocols. They will give you a routing table with two routes to the same destination — one static and one OSPF — and ask which one is active. The correct answer is always the route with the lower AD. A common trap is when both routes have the same AD — then the answer depends on specificity (longest mask wins) or on whether ECMP is enabled.

Second, they test the components of a static route. You must recognise that a valid static route needs a destination, a netmask, and a gateway (or interface). The exam will show you a misconfigured route — like one with a missing gateway — and ask why it is not working. The trap here is that FortiGate does not always warn you at configuration time if the gateway is unreachable. It just creates the route and flips it to a 'non-active' state. If you run 'get router info routing-table details', you see 'no link' or 'not reachable' next to that route.

Third, they test the concept of the default route. Questions ask: what does 0.0.0.0/0 mean as a destination? The answer: any IP address not matched by a more specific route. They will give you a routing table with a default route and a specific route to 10.10.10.0/24, then ask where a packet destined for 10.10.10.55 goes. The correct answer is the specific route, not the default route, because specific routes always take priority. The trap is that beginners think the default route matches everything equally — it does not. It only applies when no other route matches.

Fourth, they test floating static routes. You get a scenario: a company has two internet links. The primary link uses static route A with AD 10. The backup link uses static route B with AD 20. The primary link goes down. The question: what happens to the routing table? The correct answer: route A is removed from the routing table because the interface is down, and route B becomes active. The trap: some candidates think both routes stay and the firewall keeps using route A with the lower AD even though it is unreachable. FortiGate removes any route whose next hop is unreachable, regardless of AD.

Fifth, they test the difference between a route with a gateway and a route with only an interface. They ask: which type of static route is valid on a point-to-point link? The answer: both are valid, but specifying an interface without a gateway is acceptable only on point-to-point links or when the destination is directly connected. On Ethernet, you must specify the gateway. The exam will show a static route configured with an interface (like port2) but no gateway, connecting to an Ethernet switch, and ask why it fails. The answer: the firewall cannot resolve the Layer 2 MAC address without a gateway IP.

The exam also loves to test the 'blackhole' route. They describe a scenario where you want to block traffic to a specific subnet without using a firewall policy. The correct answer: configure a static route to that subnet with the blackhole flag enabled. The trap is that some candidates try to use a firewall deny policy first, which would work but is not what the question tests — they specifically ask for a routing-based solution.

Key definitions you must memorise:
- Administrative distance: a metric of route trustworthiness. Lower is better.
- Default route: 0.0.0.0/0.
- Floating static route: a backup route with a higher AD that activates when the primary route disappears.
- ECMP: equal-cost multi-path, which allows load balancing across two routes with the same destination and same AD.
- Blackhole route: a static route that silently discards packets without forwarding them.

Finally, the exam will test your ability to read a routing table output. They will show you output from 'get router info routing-table all' and ask which route is active, which is floating, or why certain routes are missing. Practise reading that output until you can spot the 'S' (static), 'C' (connected), and 'R' (RIP) or 'O' (OSPF) flags at a glance.

## Step by step

1. **Identify the destination network** — Decide which IP subnet you need to reach. For example, 192.168.100.0/24. This is the 'where do I want the packet to go' step. Without a clear destination, you cannot build a route.
2. **Identify the next hop or gateway** — Determine the IP address of the next router along the path to that destination. This is the 'who do I hand the packet to' step. In a point-to-point link, you can specify just the interface instead.
3. **Choose the outgoing interface on FortiGate** — Select the physical or virtual port on the FortiGate that connects to the router or network you identified in step 2. This ties the route to a specific cable or VLAN.
4. **Set the administrative distance** — Decide if this route is primary or backup. Use the default AD of 10 for a primary static route. Use a higher number like 20 or 100 for a backup (floating) static route. This determines which route wins if there are two routes to the same destination.
5. **Add the route in FortiOS** — Go to Network > Static Routes in the GUI or use the CLI command 'config router static' then 'edit 0' then set the destination, gateway, interface, and distance. Commit the change. The route appears in the routing table immediately if the next hop is reachable.
6. **Verification — check the routing table** — Run 'get router info routing-table all' or 'get router info routing-table details' from the CLI. Confirm the route is listed with the correct AD and is marked as active. If it shows 'not reachable' or is missing, troubleshoot the next hop or interface status.
7. **Test the route with a ping or traceroute** — From the FortiGate, ping a device on the destination network. If the ping succeeds, the route is working. If it fails, check firewall policies — a route alone does not guarantee traffic flows, because policies control whether traffic is allowed.

## Comparisons

### Static Route vs Dynamic Route (OSPF)

**Static Route:**
- Configured manually by the administrator
- Does not change unless you edit it
- Default AD is 10

**Dynamic Route (OSPF):**
- Learned automatically from neighbour routers
- Updates dynamically when the network topology changes
- Default AD is 110

### Administrative Distance (AD) vs Metric (e.g. OSPF cost)

**Administrative Distance (AD):**
- Used to choose between routes from different routing sources
- Set by the vendor or administrator
- Static route AD is 10 by default

**Metric (e.g. OSPF cost):**
- Used to choose between routes within the same routing protocol
- Calculated by the protocol based on link speed or hops
- OSPF cost is based on interface bandwidth

### Default Route (0.0.0.0/0) vs Specific Static Route (e.g. 10.10.10.0/24)

**Default Route (0.0.0.0/0):**
- Matches any IP address not matched by a specific route
- Also called the gateway of last resort
- Has the lowest priority of any route

**Specific Static Route (e.g. 10.10.10.0/24):**
- Matches only IPs within its defined subnet
- Used for accessing a particular remote network
- Takes priority over the default route

### Floating Static Route vs Primary Static Route

**Floating Static Route:**
- Has a higher AD than the primary route
- Stays inactive until the primary route is removed
- Used for backup or failover

**Primary Static Route:**
- Has the lowest AD among static routes
- Always active when the interface is up and gateway reachable
- Handles normal production traffic

### Blackhole Route vs Firewall Deny Policy

**Blackhole Route:**
- Drops packets at the routing layer before any policy check
- Configured as a static route with blackhole flag
- No log entry generated by default

**Firewall Deny Policy:**
- Drops packets at the firewall layer after routing
- Configured as a policy in the firewall rules
- Can generate logs and apply different actions

## Diagram

_Flowchart showing the packet forwarding decision process on a FortiGate based on the routing table and administrative distance._

```mermaid
flowchart TD
    A[Packet arrives at FortiGate] --> B{Check routing table for destination IP}
    B -->|Found a matching route| C[Route is active?]
    B -->|No matching route| D[Drop packet - no route found]
    C -->|Yes| E[Forward to next hop IP on specified interface]
    C -->|No| F[Check backup route with higher AD]
    F -->|Backup route active| E
    F -->|No backup route| D
    E --> G[Packet leaves FortiGate towards destination network]
```

## Common misconceptions

- **Misconception:** A static route is permanent and never disappears from the routing table until you delete it. **Reality:** A static route is removed from the routing table if its outgoing interface goes down or if the next hop becomes unreachable. It only stays in the configuration file. (Beginners confuse the configuration (which is persistent) with the active routing table (which is dynamic in real time). They think if they save a static route, it is always active, but the firewall constantly validates reachability.)
- **Misconception:** Administrative distance works like a cost metric — higher distance means the route is 'more expensive' and less preferred, but the route still carries traffic if the lower distance route is overloaded. **Reality:** AD is a purely administrative preference. Only one route per destination with the lowest AD is installed in the routing table. The other routes are not used at all unless the primary route is completely removed. (People confuse AD with dynamic protocol metrics like OSPF cost. AD is not a load-based metric. It is a tiebreaker for route selection, not a load balancer.)
- **Misconception:** You must always specify a gateway IP for every static route on FortiGate. **Reality:** You can specify only an interface without a gateway IP for point-to-point links or when the destination is directly reachable. On Ethernet, you must specify the gateway. (FortiGate's GUI sometimes defaults to showing both fields, so beginners think both are required. They do not understand the Layer 2 address resolution requirement.)
- **Misconception:** If you ping the internet, the packet is sent using the default route, so the destination in the routing table check is 0.0.0.0. **Reality:** The destination checked in the routing table is the actual IP address of the internet host, not 0.0.0.0. The default route only matches if no specific route for that IP exists. (New learners confuse the concept of a 'default' route with how the routing lookup actually works. They think the firewall substitutes 0.0.0.0 for any unknown destination, but it does a longest-prefix match against the true destination.)
- **Misconception:** FortiGate supports static routing only — dynamic protocols like OSPF are not part of a real-world FortiGate deployment. **Reality:** FortiGate fully supports multiple dynamic routing protocols including OSPF, BGP, and RIP. Static routes are just one tool, and many enterprises use both static and dynamic routes. (Beginners study only static routes for the exam and assume that is all FortiGate can do. They are surprised when real-world networks rely on BGP or OSPF with FortiGate.)

## Key takeaways

- A static route requires a destination, a netmask, and either a gateway IP or an interface name to be valid.
- The administrative distance (AD) determines which route is used when two routes have the same destination; the lower AD wins.
- A floating static route uses a higher AD than the primary route and only activates when the primary route is removed from the routing table.
- The default route 0.0.0.0/0 matches any destination that does not have a more specific route in the routing table.
- A static route that specifies only an interface (no gateway) works only on point-to-point links; on Ethernet, you must specify a gateway IP.
- The 'blackhole' flag on a static route silenty drops all traffic destined for that network without using a firewall policy.
- FortiGate automatically removes a static route from the routing table if the outgoing interface goes down or the next hop becomes unreachable.
- When two static routes have the same destination and the same AD, FortiGate can load-balance traffic across both using ECMP.

## FAQ

**What is a static route in simple terms?**

A static route is a manual entry you type into a router that tells it 'to reach this network, send the data to this specific next router.' It is like writing a turn-by-turn direction in a notebook instead of using GPS.

**What does administrative distance mean on a FortiGate?**

Administrative distance is a number from 0 to 255 that shows how trustworthy a route is. A lower number is more trustworthy. Static routes default to 10, directly connected routes are 0, and OSPF-learned routes are 110.

**How do I create a static route in FortiGate GUI?**

Go to Network > Static Routes, click Create New, enter the destination IP and netmask, set the gateway (next hop), choose the interface, and optionally change the administrative distance. Click OK to save.

**What happens if I have two static routes to the same destination?**

FortiGate installs the route with the lower administrative distance in the routing table. If both have the same AD, it may load-balance across both using ECMP. If one route's interface goes down, the firewall uses the other route automatically.

**Why is my static route showing as 'not reachable' in the routing table?**

The next hop gateway is unreachable — FortiGate cannot ping it. Check that the gateway device is powered on, the cable is connected, and the interface on FortiGate is up with a valid IP address.

**Can I delete a static route without breaking the internet?**

If the static route you delete is the only route to a destination, traffic to that destination stops until another route becomes available. Always ensure a backup route or a default route exists before deleting the primary route.

## Check your understanding

1. **What is the default administrative distance of a static route on FortiGate?**

   Answer: The default administrative distance of a static route on FortiGate is 10.

2. **A packet destined for 172.16.0.55 arrives at FortiGate. The routing table has a default route (0.0.0.0/0) and a specific route for 172.16.0.0/24. Which route is used?**

   Answer: The specific route for 172.16.0.0/24 is used because longest-prefix match means the route with the most specific subnet mask wins.

3. **You configure two static routes to the same destination network. One has AD 10, the other AD 20. What happens when the primary route's interface goes down?**

   Answer: The primary route is removed from the routing table because the interface is down, and the backup route with AD 20 becomes active automatically.

4. **When is it acceptable to configure a static route without specifying a gateway IP, providing only the interface name?**

   Answer: On point-to-point links or when the destination network is directly reachable on that interface (e.g. a serial link). On Ethernet, you must specify the gateway IP.

5. **What is the purpose of a blackhole static route?**

   Answer: A blackhole route silently discards all traffic destined for the specified network without forwarding it, and without using a firewall policy.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/fortinet-nse4/routing-basics-and-static-routes