DO NOT REPRINT

© FORTINET
Lab 1: Routing

In this lab, you will configure the router settings, and try scenarios to learn how FortiGate makes routing
decisions.

Objectives
l Route traffic based on the destination IP address, as well as other criteria.
l Balance traffic among multiple paths.
l Implement route failover.
l Implement policy routing.
l Diagnose a routing problem.

Time to Complete
Estimated: 50 minutes

Prerequisites
Before beginning this lab, you must restore a configuration file to Local-FortiGate.

To restore the Local-FortiGate configuration file

1. On the Local-Windows VM, open a browser and log in to the Local-FortiGate GUI at 10.0.1.254 with the user
name admin and password password.
2. In the upper-right corner of the screen, click admin, and then click Configuration > Restore.

3. Click Local PC, and then click Upload.

4. Click Desktop > Resources > FortiGate-Infrastructure > Routing > local-routing.conf, and then click
Open.
5. Click OK.
6. Click OK to reboot.

FortiGate Infrastructure 6.0 Lab Guide 17

Fortinet Technologies Inc.
DO NOT REPRINT
© FORTINET
Exercise 1: Configuring Route Failover

In the lab network, Local-FortiGate has two interfaces connected to the Internet: port1 and port2. During this
exercise, you will configure the port1 connection as the primary Internet link, and the port2 connection as the
backup Internet link. Local-FortiGate should use the port2 connection only if the port1 connection is down. To
achieve this objective, you will configure two default routes with different administrative distances, as well as
configure two link health monitors.

Verify the Routing Configuration

First, you'll verify the existing routing configuration on Local-FortiGate.

Take the Expert Challenge!

On the Local-FortiGate GUI (10.0.1.254 | admin/password), complete the following:

l View the existing static route configuration on Local-FortiGate.

l Enable the Distance and Priority columns in the static route configuration page.
l Make note of the Distance and Priority values of the existing default route.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Configure a Second Default Route on page 19.

To verify the routing configuration

1. On the Local-Windows VM, open a browser and log in to the Local-FortiGate GUI at 10.0.1.254 with the user
name admin and password password.
2. Click Network > Static Routes.
3. Verify the existing default route for port1.

4. Right-click any of the columns to open the context-sensitive menu.

5. In the Available Columns section, select Distance and Priority, and then click Apply.

18 FortiGate Infrastructure 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT1: Configuring
REPRINT Route Failover Configure a Second Default Route

© FORTINET

The Distance and Priority columns display.

Note that, by default, static routes have a Distance value of 10, and a Priority value of 0.

Configure a Second Default Route

You will create a second default route using the port2 interface. To make sure this second default route remains
inactive, you will assign it a higher distance.

Take the Expert Challenge!

l On Local-FortiGate GUI, configure a second default route using port2.
l Assign it a Distance of 20, and Priority of 5.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Configure the Firewall Policies on page 20.

To configure a second default route

1. Continuing on the Local-FortiGate GUI, click Network > Static Routes.
2. Click Create New.
3. Configure the following settings:

FortiGate Infrastructure 6.0 Lab Guide 19

Fortinet Technologies Inc.
DO Configure
NOTtheREPRINT
Firewall Policies Exercise 1: Configuring Route Failover

© FORTINET
Field Value

Gateway 10.200.2.254

Interface port2

Administrative Distance 20

4. Click the plus (+) icon to expand the Advanced Options section.
5. In the Priority field, enter a value of 5.

6. Click OK.
A second default route is added.

Configure the Firewall Policies

You will modify the existing Full_Access firewall policy to log all sessions. You will also create a second firewall
policy to allow traffic through the secondary interface.

20 FortiGate Infrastructure 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT1: Configuring
REPRINT Route Failover Configure the Firewall Policies

© FORTINET
Take the Expert Challenge!
l Continuing on Local-FortiGate, enable logging for all sessions in the existing Full_Access firewall policy.
l Create a second firewall policy named Backup_Access.
l Configure the Backup_Access policy to allow traffic from port3 to port2 with NAT enabled.
l Enable logging on the Backup_Access policy for all sessions.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see View the Routing Table on page 22

To configure the firewall policies

1. Continuing on the Local-FortiGate GUI, click Policy & Objects > IPv4 Policy.
2. Double-click the existing Full_Access policy to edit it.
3. Enable logging for All Sessions.

All Sessions logging ensures that all traffic is logged, and not just sessions inspected
by security profiles. This will assist in verifying traffic routing using the Forward
Traffic logs.

4. Click OK.
5. Click Create New.
6. Configure a second firewall policy with the following settings:

Field Value

Name Backup_Access

Incoming Interface port3

Outgoing Interface port2

Source LOCAL_SUBNET

FortiGate Infrastructure 6.0 Lab Guide 21

Fortinet Technologies Inc.
DO View
NOT REPRINT
the Routing Table Exercise 1: Configuring Route Failover

© FORTINET
Field Value

Destination all

Schedule always

Service ALL

Action Accept

NAT  <enable>

7. Enable logging for All Sessions.

8. Click OK.

View the Routing Table

The Local-FortiGate configuration now has two default routes with different distances. You will view the routing
table to see which one is active.

To view the routing table

1. Continuing on the Local-Windows VM, open PuTTY and connect over SSH to the LOCAL-FORTIGATE saved
session.
2. At the login prompt, enter the user name admin and password password.
3. Enter the following command to confirm the list of active routes in the routing table:
get router info routing-table all

Note that the second default route is not listed.

4. Enter the following CLI command to list both active and inactive routes:
get router info routing-table database

5. Confirm that the second default route is listed as inactive.

22 FortiGate Infrastructure 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT1: Configuring
REPRINT Route Failover Configure Link Health Monitors

© FORTINET
Stop and think!
Why is the port2 default route inactive?

The port2 default route has a higher administrative distance than the port1 default route. When two or
more routes to the same destination have different distances, the lower distance route is always active.

6. Leave the PuTTY session open.

Configure Link Health Monitors

You will configure two link health monitors to monitor the status of both the port1 and port2 routes.

To configure link health monitoring

1. Continuing on the LOCAL-FORTIGATE PuTTY session, enter the following CLI commands to create a link
health monitor for port1 on Local-FortiGate.
config system link-monitor
edit port1-monitor
set srcintf port1
set server 4.2.2.1
set gateway-ip 10.200.1.254
set protocol ping     
set update-static-route enable
next

2. Configure another link health monitor for port2.

edit port2-monitor
set srcintf port2
set server 4.2.2.2
set gateway-ip 10.200.2.254
set protocol ping     
set update-static-route enable
end

3. Leave your PuTTY session open.

Test the route failover

First you will access various websites, and use the Forward Traffic logs to verify that port1 route is being used.
Next you will force a failover by reconfiguring the port1 link health monitor to ping an invalid IP address. You will
then generate some more traffic, and use the Forward Traffic logs to verify that the port2 route is being used.

To confirm port1 route is primary

1. Return to the browser tab where you are logged into the Local-FortiGate GUI, and click Log & Report > Forward
Traffic.
2. Right-click any of the columns to open the context-sensitive menu.
3. In the Available Columns section, select Destination Interface.

FortiGate Infrastructure 6.0 Lab Guide 23

Fortinet Technologies Inc.
DO Test
NOT REPRINT
the route failover Exercise 1: Configuring Route Failover

© FORTINET

4. Scroll down in the right-click menu and click Apply.

The Destination Interface column is displayed.

5. Open a few new tabs in the web browser, and go to a few websites:
l http://www.pearsonvue.com/fortinet
l http://cve.mitre.org
l http://www.eicar.org
4. Return to the browser tab where you are logged into the Local-FortiGate GUI, and click Log & Report > Forward
Traffic.
5. Click the refresh icon.

6. Locate the relevant log entries for the three websites you accessed, and verify that their Destination Interface
indicates port1.

24 FortiGate Infrastructure 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT1: Configuring
REPRINT Route Failover Test the route failover

© FORTINET

This verifies that the port1 route is currently active and in use.

To force the failover

1. Return to the open LOCAL-FORTIGATE PuTTY session, and enter the following CLI commands to modify the
port1 link monitor:
config system link-monitor
edit port1-monitor
set server 10.200.1.13
next
end

2. Wait a few seconds.

Since 10.200.1.13 is a non-existent host in the lab network, the link health monitor will not receive any
replies. Because of this, the link health monitor will assume that the port1 Internet connection is down, and
remove the corresponding route from the routing table.

3. Leave your PuTTY session open.

To verify the route change

1. Return to the browser tab where you are logged into the Local-FortiGate GUI, and click Log & Report > System
Events.
Verify that Local-FortiGate detected the link monitor failure and removed the corresponding port1 route.

2. Click Monitor > Routing Monitor.

3. Verify that the port2 route is active in the routing table.

FortiGate Infrastructure 6.0 Lab Guide 25

Fortinet Technologies Inc.
DO Restore
NOTtheREPRINT
routing table Exercise 1: Configuring Route Failover

© FORTINET
To verify traffic logs
1. Continuing on the Local-Windows VM, open a few new tabs in the web browser, and go to a few websites:
l http://www.pearsonvue.com/fortinet
l http://cve.mitre.org
l http://www.eicar.org
2. Return to the browser tab where you are logged into the Local-FortiGate GUI, and click Log & Report > Forward
Traffic.
3. Locate the relevant log entries for the three websites you accessed, and verify that their Destination Interface
indicates port2.

This verifies that Local-FortiGate is using the port2 default route.

Restore the routing table

Before starting the next exercise, you will restore the port1 link health monitor's server configuration with a valid
host address, which will restore the port1 default route as the active route in the routing table.

To restore the port1 health monitor configuration

1. Return to the open LOCAL-FORTIGATE PuTTY session, and enter the following CLI commands.
config system link-monitor
edit port1-monitor
set server 4.2.2.1
next
end

2. Close the PuTTY session.

To verify the routing table

1. Return to the browser tab where you are logged into the Local-FortiGate GUI, and click Monitor > Routing
Monitor.
2. Verify that the port2 route is removed, and the port1 route is active.

26 FortiGate Infrastructure 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT1: Configuring
REPRINT Route Failover Restore the routing table

© FORTINET

3. Close the browser.

FortiGate Infrastructure 6.0 Lab Guide 27

Fortinet Technologies Inc.
DO NOT REPRINT
© FORTINET
Exercise 2: Equal Cost Multipath and Policy Routing

In this exercise, you'll configure equal cost multipath (ECMP) routing on Local-FortiGate to balance the Internet
traffic between port1 and port2. After that, you'll configure a policy route to route HTTPS traffic through port1
only.

Configure Administrative Distance

To establish ECMP, first you will configure multiple static routes with the same administrative distance.

Take the Expert Challenge!

On the Local-FortiGate GUI (10.0.1.254 | admin/password), complete the following:

l Change the port2 static route administrative Distance to 10.

l Verify that both port1 and port2 default routes are active in the routing table.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Change the ECMP Load Balancing Method on page 29.

To configure administrative distance

1. On the Local-Windows VM, open a browser and log in to the Local-FortiGate GUI at 10.0.1.254 with the user
name admin and password password.
2. Click Network > Static Routes.
3. Double-click the port2 static route to edit it.
4. Change the Administrative Distance to 10.

5. Click OK.

28 FortiGate Infrastructure 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT2: REPRINT
Equal Cost Multipath and Policy Routing Change the ECMP Load Balancing Method

© FORTINET
To verify the routing table
1. Continuing on the Local-FortiGate GUI, click Monitor > Routing Monitor.
2. Verify that both default routes are now active:

Change the ECMP Load Balancing Method

By default, the ECMP load balancing method is based on source IP. This works well when there are multiple
clients generating traffic. In the lab network, because you have only one client (Local-Windows), the source IP
method will not balance any traffic to the second route. Only one route will always be used. For this reason, you
will change the load balancing method to use both source and destination IP. Using this method, as long as the
traffic goes to multiple destination IP addresses, FortiGate will balance the traffic across both routes.

To modify the ECMP load balancing method

1. Continuing on the Local-Windows VM, open PuTTY and connect over SSH to the LOCAL-FORTIGATE saved
session.
2. At the login prompt, enter the user name admin and password password.
3. Enter the following CLI commands to change the ECMP load-balancing method.
config system settings
set v4-ecmp-mode source-dest-ip-based
end

4. Leave the PuTTY session open.

Verify Traffic Routing

You will generate some HTTP traffic and verify traffic routing using the Forward Traffic logs.

FortiGate Infrastructure 6.0 Lab Guide 29

Fortinet Technologies Inc.
DO Configure
NOTPriority
REPRINT Exercise 2: Equal Cost Multipath and Policy Routing

© FORTINET
Take the Expert Challenge!
l On Local-Windows, open a few new browser tabs and generate some HTTP traffic.
l Verify the traffic routing on Local-FortiGate using the Forward Traffic logs.
l Identify why all the outgoing packets are still being routed through port1.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Configure Priority on page 30.

To verify traffic routing

1. On the Local-Windows VM, open new tabs in the web browser, and go to a few websites:
l http://www.pearsonvue.com/fortinet
l http://cve.mitre.org
l http://www.eicar.org
2. Return to the browser tab where you are logged into the Local-FortiGate GUI, and click Log & Report > Forward
Traffic.
3. Identify the Destination Interface in the relevant log entries for the websites you accessed.

Why are all the outgoing packets still being routed through port1?

Stop and think!

The port2 route is not being used because it was configured with a higher priority value than the port1
route (see Configure a Second Default Route on page 19). When two routes to the same destination have
the same administrative distance, both remain active. However, if the priorities are different, the route with
the lowest priority value is used. So, to achieve ECMP with static routes, the distance and priority values
must be the same for both routes.

Configure Priority

You will change the priority value for the port2 route to match the port1 route.

30 FortiGate Infrastructure 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT2: REPRINT
Equal Cost Multipath and Policy Routing Verify ECMP

© FORTINET
Take the Expert Challenge!
On Local-FortiGate, modify the static routing configuration so both default routes are eligible for ECMP.

If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Verify ECMP on page 31

To configure priority
1. Continuing on the Local-FortiGate GUI, click Network > Static Routes.
2. Double-click the port2 default route to edit it.
3. Click the plus (+) icon to expand the Advanced Options section.
4. Change the Priority value to 0.
5. Click OK.

Verify ECMP

Now that both port1 and port2 routes share the same distance and priority values, they are eligible for
ECMP. First, you will verify the routing table, and then verify traffic routing using the Forward Traffic logs.

To verify the routing table

1. Return to the open LOCAL-FORTIGATE PuTTY session, and enter the following CLI commands on Local-
FortiGate:
get router info routing-table database

2. Verify that both default routes are currently active:

FortiGate Infrastructure 6.0 Lab Guide 31

Fortinet Technologies Inc.
DO Configure
NOTPolicy REPRINT
Route for HTTPS Traffic Exercise 2: Equal Cost Multipath and Policy Routing

© FORTINET
To configure the CLI sniffer
1. Continuing on the LOCAL-FORTIGATE PuTTY session, enter the following CLI commands:
diagnose sniffer packet any 'tcp[13]&2==2 and port 80' 4

The filter 'tcp[13]&2==2' matches packets with the SYN flag on, so the output will show
all SYN packets to port 80 (HTTP).

2. Leave the PuTTY window open in the background.

To verify ECMP routing

1. On the Local-Windows VM, open new tabs in the web browser, and go to a few websites:
l http://www.pearsonvue.com/fortinet/
l http://cve.mitre.org
l http://www.eicar.org
2. Return to the open LOCAL-FORTIGATE PuTTY session, and press Ctrl+C to stop the sniffer.
3. Analyze the sniffer output.

The SYN packets are egressing both port1 and port2. This verifies that Local-FortiGate is now load
balancing all Internet traffic across both routes.

4. Leave the PuTTY session open.

Configure Policy Route for HTTPS Traffic

You will force all HTTPS traffic to egress through port1 using a policy route. All other traffic should remain
unaffected and balanced between port1 and port2. To implement this, you will configure a policy route.

32 FortiGate Infrastructure 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT2: REPRINT
Equal Cost Multipath and Policy Routing Configure Policy Route for HTTPS Traffic

© FORTINET
To configure a policy route for HTTPS traffic
1. Return to the browser tab where you are logged into the Local-FortiGate GUI, and click Network > Policy
Routes.
2. Click Create New.
3. Configure the following settings:

Field Value

Protocol TCP

Incoming interface port3

Source address > IP/Netmask 10.0.1.0/24

Destination Address > IP/Netmask 0.0.0.0/0

Source Ports From 1 to 65535

Destination Ports From 443 to 443

Action Forward Traffic

Outgoing Interface <enable> and port1

Gateway Address 10.200.1.254

The policy route should look like the following example:

4. Click OK.

FortiGate Infrastructure 6.0 Lab Guide 33

Fortinet Technologies Inc.
DO Verify
NOT REPRINT
the Policy Route Exercise 2: Equal Cost Multipath and Policy Routing

© FORTINET
Verify the Policy Route

First, you will verify the routing table, and then verify policy routing by generating HTTPS traffic and viewing the
CLI sniffer output.

To verify the policy route table

1. Continuing on the Local-FortiGate GUI, click Monitor > Routing Monitor.
2. Click Policy.

3. Verify that the policy route is added to the policy route table.

To verify policy routing for HTTPS traffic

1. Return to the open LOCAL-FORTIGATE PuTTY session, and enter the following CLI commands on Local-
FortiGate:
diagnose sniffer packet any 'tcp[13]&2==2 and port 443' 4

As before, this sniffer filter matches packets with the SYN flag on, but this time for port
443 (HTTPS).

Leave the PuTTY window open in the background.

2. On the Local-Windows VM, open new tabs in the web browser, and then go to a few HTTPS websites:
l https://www.fortiguard.com
l https://support.fortinet.com
3. Return to the LOCAL-FORTIGATE PuTTY session, and then press Ctrl+C to stop the sniffer.
4. Analyze the sniffer output:

34 FortiGate Infrastructure 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT2: REPRINT
Equal Cost Multipath and Policy Routing Verify the Policy Route

© FORTINET

The SYN packets are egressing port1 only. This verifies that Local-FortiGate is applying the policy route for
HTTPS traffic.

To verify non-HTTPS traffic routing

1. Continuing on your LOCAL-FORTIGATE PuTTY session, enter the following CLI command:
diagnose sniffer packet any 'tcp[13]&2==2 and port 80' 4

2. On the Local-Windows VM, open new tabs in the web browser, and then go to a few HTTP websites:
l http://www.pearsonvue.com/fortinet/
l http://cve.mitre.org
l http://www.eicar.org
3. Return to the open LOCAL-WINDOWS PuTTY session, and press Ctrl+C to stop the sniffer.
4. Analyze the sniffer output:

HTTP (port 80) traffic remains unaffected by the policy route, and is still load balanced across both port1 and
port2 routes.

FortiGate Infrastructure 6.0 Lab Guide 35

Fortinet Technologies Inc.
DO Verify
NOT REPRINT
the Policy Route Exercise 2: Equal Cost Multipath and Policy Routing

© FORTINET
Stop and think!
The Local-FortiGate configuration still has the two link health monitors for port1 and port2. Do they also
enable routing failover for ECMP scenarios?

Yes. If Local-FortiGate detects a problem in any of the routes, the link monitor will remove the
corresponding route, and all Internet traffic will be routed through the remaining route.

5. Close the PuTTY session and browser.

36 FortiGate Infrastructure 6.0 Lab Guide

Fortinet Technologies Inc.