NSE4 · Question #225
Examine the static route configuration shown below; then answer the question following it. config router static edit 1 set dst 172.20.1.0 255.255.255.0 set device port1 set gateway 172.11.12.1 set…
The correct answer is B. As long as port1 is up, all the traffic to 172.20.1.0/24 will be routed by the static route number 1. If C. The FortiGate unit will NOT create a session entry in the session table when the traffic is being. Route 1 is preferred over the blackhole route (route 2) if port1 is operational due to the FortiGate's routing precedence, and traffic matching a blackhole route is dropped without creating a session.
Question
Examine the static route configuration shown below; then answer the question following it. config router static edit 1 set dst 172.20.1.0 255.255.255.0 set device port1 set gateway 172.11.12.1 set distance 10 set weight 5 next edit 2 set dst 172.20.1.0 255.255.255.0 set blackhole enable set distance 5 set weight 10 next end Which of the following statements correctly describes the static routing configuration provided? (Select all that apply.)
Options
- AAll traffic to 172.20.1.0/24 will always be dropped by the FortiGate unit.
- BAs long as port1 is up, all the traffic to 172.20.1.0/24 will be routed by the static route number 1. If
- CThe FortiGate unit will NOT create a session entry in the session table when the traffic is being
- DThe FortiGate unit will create a session entry in the session table when the traffic is being routed
- ETraffic to 172.20.1.0/24 will be shared through both routes.
How the community answered
(32 responses)- A9% (3)
- B81% (26)
- D3% (1)
- E6% (2)
Why each option
Route 1 is preferred over the blackhole route (route 2) if `port1` is operational due to the FortiGate's routing precedence, and traffic matching a blackhole route is dropped without creating a session.
Traffic will only be dropped by the blackhole route (route 2) if route 1 is not active (e.g., if `port1` is down); otherwise, traffic is routed via route 1.
FortiGate routing prioritizes routes with an associated up interface over blackhole routes, even if the blackhole has a lower administrative distance. Therefore, as long as `port1` is up, route 1 (with destination `172.20.1.0/24` via `port1`) will be used. If `port1` goes down, route 1 becomes inactive, and route 2 (the blackhole) would then become the active route.
When a blackhole route (`set blackhole enable`) is used, the FortiGate silently discards traffic destined for that network. Since the traffic is immediately dropped and not forwarded or processed further, no session entry is created in the session table.
Traffic routed via a blackhole route is silently discarded, and the FortiGate does not create a session entry for such discarded traffic to conserve resources.
The FortiGate will select a single best route based on its routing table logic (administrative distance, metric, interface status); it does not share traffic between two static routes for the same destination in this manner.
Concept tested: Static route precedence, blackhole route behavior, session table interaction
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/33917/static-routing
Topics
Community Discussion
No community discussion yet for this question.