Domain 4 Routing
trapmemorisedefault valuenew in 7.6
§4.1 Static routing & the routing table
ECMP load-balance methods (set v4-ecmp-mode): source-ip-based (default) · source-dest-ip-based · weighted-load-balance · usage-based (spillover).
Blackhole routes drop traffic silently. Standard use: pair one with a route-based IPsec tunnel at a higher distance, so traffic doesn't leak out the default route when the tunnel drops.
Policy routes are evaluated before the routing table.
Reverse Path Forwarding. FortiGate source-checks the first packet of every session.
reverse path check fail, drop in debug flow is almost always a missing or wrong route back toward the source — not a policy problem. set asymroute enable disables the check and is the wrong answer unless the question explicitly wants asymmetric routing tolerated.
§4.2 SD-WAN
Building blocks: zones → members (interfaces) → performance SLAs → rules.
A member is unusable without a static default route pointing at the sd-wan virtual interface. No route, no rule selection — regardless of how healthy the link is.
Health check probes: Ping, HTTP, HTTPS, DNS, TCP-echo, UDP-echo, TWAMP. Each SLA sets targets for latency, jitter and packet loss, optionally minimum bandwidth. Detection timing comes from interval, failtime and recoverytime.
The four rule strategies:
Evaluation order: policy routes → SD-WAN rules → routing table. Unmatched traffic hits the implicit rule at the bottom, which load-balances by source IP by default.
An SLA showing state(alive) but a service showing no members means the link is up but is not meeting the SLA targets. Alive ≠ eligible.