Author Archives: Mike

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

Classful versus classless routing protocols

Classful versus classless routing protocols

Classful or classless routing refers to how the routing protocol handes the IP addresses. In classful addresses there is the specific address, and the host address of the server that address is connected to. Classless addresses use a combination of IP address and netmask.

Classless Inter-Domain Routing (CIDR) was introduced in 1993 (originally with RFC 1519 and most recently with RFC 4632) to keep routing tables from getting too large. With Classful routing, each IP address requires its own entry in the routing table. With Classless routing, a series of addresses can be combined into one entry potentially saving vast amounts of space in routing tables.

Current routing protocols that support classless routing out of necessity include RIPv2, BGP, IS-IS, and OSPF. Older protocols such as RIPv1 do not support CIDR addresses.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Dynamic routing protocols

Dynamic routing protocols

A dynamic routing protocol is an agreed-on method of routing that the sender, receiver, and all routers along the path (route) support. Typically the routing protocol involves a process running on all computers and routers along that route to enable each router to handle routes in the same way as the others. The routing protocol determines how the routing tables are populated along that route, how the data is formatted for transmission, and what information about a route is included with that route. For example RIP, and BGP use distance vector algorithms, where OSPF uses a shortest path first algorithm. Each routing protocol has different strengths and weaknesses — one protocol may have fast convergence, while another may be very reliable, and a third is very popular for certain businesses like Internet Service Providers (ISPs).

Dynamic routing protocols are different from each other in a number of ways, such as:

  • Classful versus classless routing protocols
  • Interior versus exterior routing protocols
  • Distance vector versus link-state protocols

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Comparing static and dynamic routing

Comparing static and dynamic routing

A common term used to describe dynamic routing is convergence. Convergence is the ability to work around network problems and outages — for the routing to come together despite obstacles. For example, if the main router between two end points goes down, convergence is the ability to find a way around that failed router and reach the destination. Static routing has zero convergence beyond trying the next route in its limited local routing table — if a network administrator doesn’t fix a routing problem manually, it may never be fixed, resulting in a downed network. Dynamic routing solves this problem by involving routers along the route in the decision-making about the optimal route, and using the routing tables of these routers for potential routes around the outage. In general, dynamic routing has better scalability, robustness, and convergence. However, the cost of these added benefits include more complexity and some overhead: the routing protocol uses some bandwidth for its own administration.

Comparing static and dynamic routing

 

Feature Static Routing Dynamic Routing
 

Hardware sup- port

 

Supported by all routing hardware

 

May require special, more expensive routers

 

Router Memory

Required

 

Minimal

 

Can require considerable memory for larger tables

 

Complexity

 

Simple

 

Complex

Overhead                  None                                                    Varying amounts of bandwidth used for routing protocol updates

Scalability                Limited to small networks                    Very scalable, better for larger networks

Robustness              None – if a route fails it has to be fixed manually

Robust – traffic routed around failures auto- matically

 

 

Convergence           None                                                    Varies from good to excellent

 


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Dynamic Routing Overview

 Dynamic Routing Overview

This section provides an overview of dynamic routing, and how it compares to static routing. For details on various dynamic routing protocols, see the following chapters for detailed information.

The following topics are included in this section: What is dynamic routing?

Comparison of dynamic routing protocols

Choosing a routing protocol Dynamic routing terminology IPv6 in dynamic routing

 

 

What is dynamic routing?

Dynamic routing uses a dynamic routing protocol to automatically select the best route to put into the routing table. So instead of manually entering static routes in the routing table, dynamic routing automatically receives routing updates, and dynamically decides which routes are best to go into the routing table. Its this intelligent and hands-off approach that makes dynamic routing so useful.

Dynamic routing protocols vary in many ways and this is reflected in the various administrative distances assigned to routes learned from dynamic routing. These variations take into account differences in reliability, speed of convergence, and other similar factors. For more information on these administrative distances, see Advanced Static Routing on page 256.

This section includes:

  • Comparing static and dynamic routing
  • Dynamic routing protocols
  • Minimum configuration for dynamic routing

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Static routing example

Static routing example

This is an example of a typical small network configuration that uses only static routing.

This network is in a dentist office that includes a number of dentists, assistants, and office staff. The size of the office is not expected to grow significantly in the near future, and the network usage is very stable—there are no new applications being added to the network.

 

The users on the network are:

  • Admin staff – access to local patient records, and perform online billing
  • Dentists – access and update local patient records, research online from desk
  • Assistants – access and update local patient records in exam rooms

The distinction here is mainly that only the admin staff and dentist’s office need access to the Internet—all the other traffic is local and doesn’t need to leave the local network. Routing is only required for the outbound traffic, and the computers that have valid outbound traffic.

Configuring routing only on computers that need it acts as an additional layer of secur- ity by helping prevent malicious traffic from leaving the network.

This section includes the following topics:

  • Network layout and assumptions
  • General configuration steps
  • Configure FortiGate unit
  • Configure Admin PC and Dentist PCs
  • Testing network configuration

Network layout and assumptions

The computers on the network are admin staff computers, dentist office computers, and dental exam room computers. While there are other devices on the local network such as printers, they do not need Internet access or any routing.

This networked office equipment includes 1 admin staff PC, 3 dentist PCs, and 5 exam room PCs. There are also a network printer, and a router on the network as well.

Assumptions about these computers, and network include:

  • The FortiGate unit is a model with interfaces labeled port1 and port2.
  • The FortiGate unit has been installed and is configured in NAT/Route mode.
  • VDOMs are not enabled.
  • The computers on the network are running MS Windows software.
  • Any hubs required in the network are not shown in the network diagram.
  • The network administrator has access to the ISP IP addresses, and is the super_admin administrator on the FortiGate unit.

 

Static routing example device names, IP addresses, and level of access

 

Device Name(s) IP address Need external access?
 

Router

 

192.168.10.1

 

YES

 

Admin

 

192.168.10.11

 

YES

 

Device Name(s) IP address Need external access?
 

Dentist13

 

192.168.10.21-23

 

YES

 

Exam15

 

192.168.10.31-35

 

NO

 

Printer

 

192.168.10.41

 

NO


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Transparent mode static routing

Transparent mode static routing

FortiOS operating modes allow you to change the configuration of your FortiGate unit depending on the role it needs to fill in your network.

NAT/Route operating mode is the standard mode where all interfaces are accessed individually, and traffic can be routed between ports to travel from one network to another.

In transparent operating mode, all physical interfaces act like one interface. The FortiGate unit essentially becomes a bridge — traffic coming in over any interface is broadcast back out over all the interfaces on the FortiGate unit.

In transparent mode, there is no entry for routing at the main level of the menu on the web-based manager display as there is in NAT/Route mode. Routing is instead accessed through the network menu option.

To view the routing table in transparent mode, go to System > Network > Routing Table.

When viewing or creating a static route entry in transparent mode there are only three fields available.

Destination IP / Mask The destination of the traffic being routed. The first entry is attempted first for a match, then the next, and so on until a match is found or the last entry is reached. If no match is found, the traffic will not be routed.

Use 0.0.0.0 to match all traffic destinations. This is the default route.

GatewaSpecifies the next hop for the traffic. Generally the gateway is the address of a router on the edge of your network.

Priority  The priority is used if there is more than one match for a route. This allows multiple routes to be used, with one preferred. If the preferred route is unavailable the other routes can be used instead.

Valid range of priority can be from 0 to 4 294 967 295.

If more than one route matches and they have the same priority it becomes an ECMP situation and traffic is shared among those routes. See Trans- parent mode static routing on page 275.

When configuring routing on a FortiGate unit in transparent mode, remember that all interfaces must be connected to the same subnet. That means all traffic will be coming from and leaving on the same subnet. This is important because it limits your static routing options to only the gateways attached to this subnet. For example,

if you only have one router connecting your network to the Internet then all static routing on the FortiGate unit will use that gateway. For this reason static routing on FortiGate units in transparent mode may be a bit different, but it is not as complex as routing in NAT/Route mode.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Moving a policy route

Moving a policy route

A routing policy is added to the bottom of the routing table when it is created. If you prefer to use one policy over another, you may want to move it to a different location in the routing policy table.

The option to use one of two routes happens when both routes are a match, for example

172.20.0.0/255.255.0.0 and 172.20.120.0/255.255.255.0. If both of these routes are in the

policy table, both can match a route to 172.20.120.112 but you consider the second one as a better match. In that case the best match route should be positioned before the other route in the policy table.

To change the position of a policy route in the table, go to Router > Static > Policy Routes and select Move

To for the policy route you want to move.

Before/AfteSelect Before to place the selected Policy Route before the indicated route.

Select After to place it following the indicated route.

Policy route ID   Enter the Policy route ID of the route in the Policy route table to move the selected route before or after.

 


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Policy routing

Policy routing

Policy routing enables you to redirect traffic away from a static route. This can be useful if you want to route certain types of network traffic differently. You can use incoming traffic’s protocol, source address or interface, destination address, or port number to determine where to send the traffic. For example, generally network traffic would go to the router of a subnet, but you might want to direct SMTP or POP3 traffic directly to the mail server on that subnet.

If you have configured the FortiGate unit with routing policies and a packet arrives at the FortiGate unit, the

FortiGate unit starts at the top of the Policy Route list and attempts to match the packet with a policy. If a match

is found and the policy contains enough information to route the packet (a minimum of the IP address of the next- hop router and the FortiGate interface for forwarding packets to it), the FortiGate unit routes the packet using the information in the policy. If no policy route matches the packet, the FortiGate unit routes the packet using the routing table.

Most policy settings are optional,and a matching policy alone might not provide enough information for forwarding the packet. In fact, the FortiGate almost always requires a matching route in the routing table in order to use a policy route. The FortiGate unit will refer to the routing table in an attempt to match the information in the packet header with a route in the routing table.

Policy route options define which attributes of a incoming packet cause policy routing to occur. If the attributes of a packet match all the specified conditions, the FortiGate unit routes the packet through the specified interface to the specified gateway.

To view policy routes go to Router > Static > Policy Routes.

Create New                                 Add a policy route. See Adding a policy route on page 272.

Edit                                             Edit the selected policy route.

Delete                                         Delete the selected policy route.

Move To

Move the selected policy route. Enter the new position and select OK.

For more information, see Moving a policy route on page 274.

#                                            The ID numbers of configured route policies. These numbers are sequen- tial unless policies have been moved within the table.

 

Incoming                                    The interfaces on which packets subjected to route policies are received.

Outgoing                                    The interfaces through which policy routed packets are routed.

Source                                        The IP source addresses and network masks that cause policy routing to occur.

Destination                                The IP destination addresses and network masks that cause policy routing to occur.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!