Fortinet FortiGate: Static Route Configuration via GUI and CLI

FortiGate Static Route Configuration

When managing network devices like Fortinet FortiGate, configuring routing is a crucial step in ensuring that traffic flows seamlessly within and beyond your network. Among the various routing options available, static routes serve as a fundamental tool for defining precise paths for data to reach specific destinations.

What are Static Routes?

Static routes are manually configured routes that define specific paths for network traffic to follow. Unlike dynamic routing protocols, which automatically adjust routes based on current network conditions, static routes require manual configuration. This makes them simple and predictable, ideal for networks with stable topologies or specific routing requirements.

Benefits of Static Routes

Simplicity: Static routes are easy to configure and maintain, making them ideal for small networks or straightforward routing needs.
Predictability: Because they do not change unless manually altered, static routes offer predictable paths for network traffic.
Control: Administrators have complete control over the routing path, allowing for customized traffic flow.

Static Route Configuration Examples

Let’s consider a scenario where you want to configure a static route to direct traffic destined for the 192.168.10.0/24 network through a gateway at 192.168.20.223 using the internal interface. It is very important that the FortiGate can communicate with the defined gateway 192.168.20.223.

Option 1: Static Route CLI (Command Line Interface) Configuration

Step 1: Connect to the CLI Interface on FortiGate Firewall

Use Putty to sttart SSH Session or FortiGate CLI Console on your Fortinet Firewall GUI to access to the CLI Interface.On CLI Console you can type commands to change or add static routes or any other configuration

Step 2: Add Route in Your Configuration

Adjust your Gateway and which network you want to communicate through that gateway and type the following commands, line by line:

config router static
    edit 1
        set dst 192.168.10.0 255.255.255.0
        set gateway 192.168.20.223
        set device internal
        set distance 10
    next
end

If you are not sure which routes are configured, check it with the following command:

fgt-at # config router static


fgt-at (static) # show
config router static
    edit 1
        set dst 192.168.19.0 255.255.255.0
        set gateway 192.168.20.112
        set device "internal"
    next
    edit 2
        set dst 192.168.10.0 255.255.255.0
        set distance 4
        set device "toHQ-1"
    next
    edit 3
        set dst 192.168.11.0 255.255.255.0
        set device "toHQ-2"
    next
end

If you would like to check more details about existing route, type the following command:

fgt-at # config router static

fgt-at (static) # edit 3

fgt-at (3) # get
seq-num             : 3
status              : enable
dst                 : 192.168.11.0 255.255.255.0
distance            : 10
weight              : 0
priority            : 0
device              : toHQ-2
comment             :
blackhole           : disable
dynamic-gateway     : disable
virtual-wan-link    : disable
link-monitor-exempt : disable
bfd                 : disable

Option 2: Static Route Web Interface Configuration

1: Access the FortiGate Management Interface

2: Navigate to the Network Section

In the GUI, go to Network > Static Routes.

Check screenshot above.

3: Add a New Static Route

In the GUI, click on Create New to open the new route configuration page.

4: Configure the Route Parameters

Destination IP/Netmask: Specify the destination network and its subnet mask.
Gateway: Enter the IP address of the next hop gateway.
Interface: Select the outgoing interface for the traffic.
Distance: Set the administrative distance for the route, which determines its priority relative to other routes.