How ECMP Load Balancing Works on FortiGate
A FortiGate has multiple equal-cost routes to the same destination via two different interfaces. ECMP load balancing is enabled. What determines how traffic is distributed among the routes?
Quick Answer
The answer is a hash of source and destination IP addresses. ECMP load balancing on FortiGate distributes traffic by computing a hash from the source and destination IP fields in each packet, which ensures that all packets belonging to the same session follow the same path while different sessions are spread across the equal-cost routes. This hash-based approach is deterministic and avoids packet reordering, with the specific hash method—such as source-dest-ip or source-dest-port—controlled by the load-balance setting under the routing configuration. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of how FortiGate’s ECMP algorithm selects paths without relying on round-robin or random distribution, and a common trap is assuming that traffic is split per-packet rather than per-session. Remember the memory tip: “IPs hash the path, ports are optional math”—the core hash always uses source and destination IPs, with port-based hashing only applied when explicitly configured.
⚠ Common exam trap
Many exam-takers assume ECMP uses round-robin or interface speed weighting, but FortiGate strictly uses a hash-based algorithm to maintain flow affinity and avoid packet reordering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A hash of source and destination IP addresses
When ECMP load balancing is enabled on a FortiGate, traffic distribution among equal-cost routes is determined by a hash algorithm that uses source and destination IP addresses (and optionally ports) to select the egress interface. This ensures that all packets belonging to the same flow are consistently forwarded via the same path, preserving packet order and avoiding reordering issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The interface speed
Why it's wrong here
ECMP does not consider interface speed by default; it's per-flow hash.
- ✓
A hash of source and destination IP addresses
Why this is correct
Default ECMP uses source-dest-ip hashing.
- ✗
Round-robin per packet
Why it's wrong here
ECMP in FortiGate is per-session, not per-packet.
- ✗
The route metric
Why it's wrong here
Equal-cost means same metric; metric doesn't decide distribution.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate has two equal-cost paths to a destination network through two different ISPs. The administrator wants to load balance traffic across both links using ECMP, but notices that all traffic uses only one link. What should the administrator check first?
medium- ✓ A.Check that both routes have the same administrative distance and priority
- B.Configure 'set v4-ecmp-mode' to 'source-ip-based'
- C.Verify that 'set load-balance-eligible' is enabled on both WAN interfaces
- D.Disable 'anti-replay' on the security policy
Why A: ECMP requires that all candidate routes have identical administrative distance and priority values. If either differs, FortiGate will select only the route with the lower distance/priority, breaking load balancing. The administrator should verify these parameters first because they directly control route selection before ECMP is applied.
Variation 2. A FortiGate has two equal-cost paths to a destination network. ECMP is enabled. The administrator notices that all traffic uses the first path. What is the most likely cause?
hard- A.ECMP is configured with 'spillover' mode
- B.The second path is administratively down
- ✓ C.ECMP is configured to use 'source-dest-ip' hash and all sessions are from same source to same destination
- D.The route metric is not equal
Why C: When ECMP is configured with the 'source-dest-ip' hash algorithm, traffic is load-balanced based on a hash of both source and destination IP addresses. If all sessions originate from the same source IP and go to the same destination IP, the hash value is identical for every session, causing all traffic to be forwarded over the same path. This is the most likely cause because the administrator sees all traffic using the first path despite ECMP being enabled.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.