How to Configure a Static Route in FortiGate (GUI and CLI Step-by-Step Guide)

A firewall can only forward traffic if it knows where to send it. On a FortiGate, static routes tell the device how to reach networks that are not directly connected. This guide shows how to configure them in the GUI and CLI, and how to verify and troubleshoot them.

Menu names can differ slightly between FortiOS versions, so check your own version if something looks different.

What Is a Static Route?

A static route is a manually configured path to a destination network through a chosen next-hop and interface. It does not change unless you change it, so it is simple and predictable. It suits small networks, branch offices, and default internet routes.

Example Topology

• FortiGate LAN interface (port1): 192.168.10.1/24
• FortiGate link to a router (port2): 10.10.10.1/30
• Next-hop router: 10.10.10.2
• Remote network to reach: 192.168.50.0/24

Method 1: Configure in the GUI

1. Log in to the FortiGate and go to Network → Static Routes.
2. Click Create New.
3. Set Destination to 192.168.50.0/255.255.255.0.
4. Set Gateway Address to 10.10.10.2.
5. Set Interface to port2.
6. Leave Administrative Distance at the default unless you need a backup route.
7. Click OK.

Method 2: Configure in the CLI

config router static
    edit 1
        set dst 192.168.50.0 255.255.255.0
        set gateway 10.10.10.2
        set device port2
    next
end

Default route to the internet

config router static
    edit 2
        set dst 0.0.0.0 0.0.0.0
        set gateway <ISP-gateway-IP>
        set device wan1
    next
end

Do Not Forget the Firewall Policy

A route only tells the FortiGate where to send traffic. You still need a firewall policy to allow it. Without a policy from LAN to the route's outgoing interface, traffic is denied by default. See our guide on configuring DHCP and firewall policy in FortiGate.

Verify the Route

get router info routing-table all
get router info routing-table static
get router info routing-table details 192.168.50.10

Static routes appear with the letter S. If the route is missing from the routing table, the outgoing interface may be down or the gateway unreachable.

Test Connectivity

execute ping 192.168.50.10
execute traceroute 192.168.50.10

Backup Routes with Administrative Distance

If two routes go to the same destination, the one with the lower administrative distance wins. To create a backup path, add a second static route to the same destination with a higher distance. It stays inactive until the primary route fails.

Troubleshooting Checklist

• Is the outgoing interface up and addressed correctly?
• Is the gateway in the same subnet as the interface?
• Is there a firewall policy allowing the traffic?
• Does the remote router have a route back to your network? (Return traffic is a very common missing piece.)
• Is a more specific or lower-distance route overriding yours?

Frequently Asked Questions

Static route or dynamic routing? Use static for small, stable networks. Use OSPF or BGP when the network is large or changes often. See our OSPF with link aggregation guide.

Why does my route not show up? Usually the interface is down or the gateway is not reachable.

Conclusion

Static routes are one of the first skills every FortiGate administrator needs. Add the route, allow it with a policy, then verify with the routing table and ping. Got a routing problem? Leave the details in the comments.