FortiGate Static Route Not Working Despite Lower Distance
A network administrator notices that after configuring a new static route on a FortiGate, traffic to a remote subnet is still being forwarded via the default route. The administrator confirms the static route is present in the routing table with a lower distance than the default route. What is the MOST likely cause?
Quick Answer
The answer is that the static route's gateway is not reachable via any interface. Even when a static route has a lower administrative distance than the default route, the FortiGate will not use it if the next-hop gateway is unreachable; the routing table only installs routes whose gateways are directly connected and active. This occurs because the FortiGate performs a recursive lookup on the gateway IP—if that IP is not reachable through a connected interface or another valid route, the static route is considered invalid and is omitted from the forwarding decision, leaving the higher-distance default route as the only viable path. On the Fortinet NSE 4 exam, this scenario tests your understanding of route selection prerequisites beyond distance metrics, often appearing as a trick where candidates assume a lower distance always wins. A common memory tip is “gateway first, distance second”—the route must be reachable before distance even matters.
⚠ Common exam trap
It's easy for candidates to assume a static route with a lower administrative distance will always override the default route, but they overlook the critical requirement that the next-hop must be directly reachable for the route to be active in FortiGate's routing table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The static route's gateway is not reachable via any interface.
If the gateway specified in the static route is not reachable via any interface (e.g., the next-hop IP is not on a directly connected subnet or there is no ARP resolution), FortiGate will not install the route in the forwarding information base (FIB). The route may appear in the routing table but will be marked as inactive, causing traffic to still use the default route with a higher distance. FortiGate requires the next-hop to be reachable on a directly connected interface for the static route to be active.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The static route is disabled by a firewall policy.
Why it's wrong here
Firewall policies do not disable routes; they control traffic flow through the FortiGate.
- ✗
The static route is configured with a higher priority than the default route.
Why it's wrong here
Priority is not used in static route selection; distance is used.
- ✗
The static route's destination subnet overlaps with a directly connected subnet.
Why it's wrong here
Overlapping subnets would not cause traffic to use the default route; they would cause ambiguity but typically the more specific route wins.
- ✓
The static route's gateway is not reachable via any interface.
Why this is correct
If the next-hop gateway is unreachable (no ARP entry or interface down), the route will not be installed in the routing table, and traffic will use the default route.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. After upgrading FortiGate firmware from 6.0 to 7.2, an administrator notices that a static route pointing to a next-hop IP 10.0.0.1 is no longer working. The route is present in the configuration but the FortiGate shows it as 'not active'. What is the MOST likely cause?
medium- A.FortiGate now requires a default administrative distance of 10 for static routes
- B.The route was deleted during the upgrade and needs to be re-added
- ✓ C.The next-hop IP is not directly connected to any FortiGate interface
- D.The remote gateway is down
Why C: In FortiOS 7.2, a static route is considered 'active' only if the next-hop IP is reachable via a directly connected interface. If the next-hop IP 10.0.0.1 is not on a directly connected subnet, the route will be present in the configuration but marked as 'not active'. This is a fundamental routing principle: the next hop must be directly reachable (i.e., the router must have an ARP entry for it) for the route to be installed in the routing table.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.