Objective

Routing objects are the vocabulary FortiOS uses to describe route policy. This guide walks through every routing object type on a FortiGate, shows the exact CLI that creates them, and then shows every place a routing protocol can consume them, so that you stop guessing why a prefix is or is not in the table. By the end you will have a working two-edge BGP and OSPF lab with inbound filtering, outbound advertisement control, AS path prepending, community tagging, and cryptographic adjacency authentication.

Target Audience

Network engineers, network security engineers, and systems engineers running dynamic routing on FortiOS. Also useful for anyone migrating BGP or OSPF policy from IOS, NX-OS, or Junos onto a FortiGate and wondering where the familiar knobs went.

On this page

1. Prerequisites and architecture
2. The routing object catalog
3. Phase 0: expose Advanced Routing in the GUI
4. Phase 1: access lists
5. Phase 2: prefix lists
6. Phase 3: AS path lists
7. Phase 4: community lists
8. Phase 5: route maps
9. Phase 6: key chains
10. Phase 7: attaching objects to protocols
11. Verification and validation
12. Troubleshooting and gotchas
13. Naming and design standards

Design intent for the lab: we advertise the aggregate 10.0.0.0/16 to both providers, prefer ISP-A inbound and outbound, never leak 10.0.100.0/24, never accept RFC 1918 or a default route from either provider, and never become transit between AS 64512 and AS 64513.

The one rule that governs all of them: every list is an ordered sequence of permit and deny rules, evaluated lowest rule ID first, and every list ends in an implicit deny. If nothing matches, the route is dropped. This single behavior accounts for the large majority of “my routes disappeared” tickets.

config system settings
    set gui-advanced-routing enable
    set gui-dynamic-routing enable
end

config router access-list
    edit "AL-MARTIAN-DENY"
        set comments "Drop RFC1918 and default learned from transit"
        config rule
            edit 10
                set action deny
                set prefix 0.0.0.0 0.0.0.0
                set exact-match enable
            next
            edit 20
                set action deny
                set prefix 10.0.0.0 255.0.0.0
                set exact-match disable
            next
            edit 30
                set action deny
                set prefix 172.16.0.0 255.240.0.0
                set exact-match disable
            next
            edit 40
                set action deny
                set prefix 192.168.0.0 255.255.0.0
                set exact-match disable
            next
            edit 100
                set action permit
                set prefix any
            next
        end
    next
end

config router access-list
    edit "AL-BRANCH-ODD-VLANS"
        config rule
            edit 10
                set action permit
                set wildcard 10.0.1.0 0.0.254.255
            next
        end
    next
end

config router prefix-list
    edit "PL-ORIGINATE-TO-TRANSIT"
        set comments "Only the corporate aggregate leaves this AS"
        config rule
            edit 10
                set action permit
                set prefix 10.0.0.0 255.255.0.0
                unset ge
                unset le
            next
        end
    next
    edit "PL-ACCEPT-FROM-TRANSIT"
        set comments "Sane prefix length window for received routes"
        config rule
            edit 10
                set action deny
                set prefix 0.0.0.0 0.0.0.0
                set ge 25
                set le 32
            next
            edit 20
                set action permit
                set prefix 0.0.0.0 0.0.0.0
                set le 24
            next
        end
    next
end

Length operator constraint: FortiOS enforces mask length ≤ ge ≤ le ≤ 32. Configuring set ge 24 together with set le 16 is rejected at commit. Use unset ge and unset le to clear a leftover value rather than setting it to zero.

config router prefix-list6
    edit "PL6-ACCEPT-FROM-TRANSIT"
        config rule
            edit 10
                set action permit
                set prefix ::/0
                set le 48
            next
        end
    next
end

config router aspath-list
    edit "ASP-LOCAL-ORIGIN-ONLY"
        set comments "Outbound anti-transit filter"
        config rule
            edit 10
                set action permit
                set regexp "^$"
            next
        end
    next
    edit "ASP-DENY-PEER-B"
        set comments "Never accept anything transiting AS 64513"
        config rule
            edit 10
                set action deny
                set regexp "_64513_"
            next
            edit 20
                set action permit
                set regexp ".*"
            next
        end
    next
end

config router community-list
    edit "CL-FROM-ISPA"
        set type standard
        config rule
            edit 10
                set action permit
                set match "65001:100"
            next
        end
    next
    edit "CL-ANY-LOCAL-TAG"
        set type expanded
        config rule
            edit 10
                set action permit
                set regexp "65001:[0-9]+"
            next
        end
    next
    edit "CL-NO-EXPORT"
        set type standard
        config rule
            edit 10
                set action permit
                set match "no-export"
            next
        end
    next
end

Standard list AND semantics: a single rule containing two community values matches only routes carrying both. To express OR, write two separate rules with two separate rule IDs.

config router route-map
    edit "RM-ISPA-IN"
        set comments "Drop martians, mark as primary, tag for iBGP"
        config rule
            edit 10
                set action deny
                set match-ip-address "AL-MARTIAN-DENY-INVERTED"
            next
            edit 20
                set action permit
                set match-ip-address "PL-ACCEPT-FROM-TRANSIT"
                set set-local-preference 200
                set set-community "65001:100"
                set set-community-additive enable
            next
        end
    next

    edit "RM-ISPA-OUT"
        set comments "Advertise only the corporate aggregate"
        config rule
            edit 10
                set action permit
                set match-ip-address "PL-ORIGINATE-TO-TRANSIT"
                set match-as-path "ASP-LOCAL-ORIGIN-ONLY"
            next
        end
    next
end

config router route-map
    edit "RM-ISPB-IN"
        config rule
            edit 10
                set action permit
                set match-ip-address "PL-ACCEPT-FROM-TRANSIT"
                set set-local-preference 100
                set set-community "65001:200"
                set set-community-additive enable
            next
        end
    next

    edit "RM-ISPB-OUT"
        set comments "Same aggregate, prepended three times"
        config rule
            edit 10
                set action permit
                set match-ip-address "PL-ORIGINATE-TO-TRANSIT"
                set match-as-path "ASP-LOCAL-ORIGIN-ONLY"
                set set-aspath-action prepend
                set set-aspath "65001" "65001" "65001"
            next
        end
    next
end

config router prefix-list
    edit "PL-NEVER-LEAK"
        config rule
            edit 10
                set action permit
                set prefix 10.0.100.0 255.255.255.0
                set le 32
            next
        end
    next
end

config router route-map
    edit "RM-OSPF-TO-BGP"
        set comments "Redistribute OSPF into BGP, block the restricted subnet"
        config rule
            edit 10
                set action deny
                set match-ip-address "PL-NEVER-LEAK"
            next
            edit 20
                set action permit
                set set-origin igp
                set set-route-tag 65001
            next
        end
    next
end

config router key-chain
    edit "KC-OSPF-AREA0"
        config key
            edit 1
                set accept-lifetime 00:00:00 1 january 2026 23:59:59 30 june 2026
                set send-lifetime   00:00:00 1 january 2026 23:59:59 31 march 2026
                set key-string <current_key_material>
                set algorithm hmac-sha256
            next
            edit 2
                set accept-lifetime 00:00:00 1 march 2026 23:59:59 31 december 2026
                set send-lifetime   00:00:00 1 april 2026 23:59:59 31 december 2026
                set key-string <next_key_material>
                set algorithm hmac-sha256
            next
        end
    next
end

config router ospf
    config area
        edit 0.0.0.0
            set authentication message-digest
        next
    end
    config ospf-interface
        edit "CORE-UPLINK"
            set interface "port2"
            set authentication message-digest
            set md5-keychain "KC-OSPF-AREA0"
        next
    end
end

Rotation pattern: notice the overlap. Key 2 becomes acceptable a month before it is ever sent. That overlap window is what lets you roll a key across a large OSPF domain without dropping adjacencies. If both keys expire, the interface silently stops forming adjacencies and the FortiGate gives you no obvious alarm beyond a missing neighbor.

config router bgp
    set as 65001
    set router-id 10.0.255.1
    set ibgp-multipath enable
    set graceful-restart enable

    config neighbor
        edit "198.18.10.1"
            set description "ISP-A transit"
            set remote-as 64512
            set soft-reconfiguration enable
            set send-community both
            set route-map-in "RM-ISPA-IN"
            set route-map-out "RM-ISPA-OUT"
            set filter-list-in "ASP-DENY-PEER-B"
            set connect-timer 10
        next
        edit "10.0.255.2"
            set description "iBGP to FGT-EDGE-02"
            set remote-as 65001
            set update-source "loopback0"
            set next-hop-self enable
            set send-community both
            set soft-reconfiguration enable
        next
    end

    config network
        edit 1
            set prefix 10.0.0.0 255.255.0.0
        next
    end

    config redistribute "ospf"
        set status enable
        set route-map "RM-OSPF-TO-BGP"
    end

    config aggregate-address
        edit 1
            set prefix 10.0.0.0 255.255.0.0
            set summary-only enable
            set as-set enable
        next
    end
end

Address family variants: every filter field has IPv6 and VPNv4 siblings, for example route-map-in6, prefix-list-out6, and route-map-in-vpnv4. Configuring the IPv4 field alone leaves the IPv6 address family completely unfiltered, which is a very common audit finding on dual stack edges.

config router ospf
    set router-id 10.0.255.1

    # Filter what enters the local RIB from OSPF. Takes a prefix list.
    set distribute-list-in "PL-ACCEPT-FROM-CORE"

    # Conditional default origination, gated by a route map.
    set default-information-originate enable
    set default-information-metric 20
    set default-information-metric-type 2
    set default-information-route-map "RM-DEFAULT-IF-TRANSIT-UP"

    # NOTE the field name here is routemap, not route-map.
    config redistribute "bgp"
        set status enable
        set metric 100
        set metric-type 2
        set routemap "RM-BGP-TO-OSPF"
    end

    # Per protocol outbound filtering. Takes an ACCESS list.
    config distribute-list
        edit 1
            set access-list "AL-BLOCK-MGMT"
            set protocol connected
        next
    end

    config area
        edit 0.0.0.0
            # ABR inter-area filtering. Takes a PREFIX list.
            config filter-list
                edit 1
                    set list "PL-ABR-SUMMARY-OUT"
                    set direction out
                next
            end
        next
    end
end

show router access-list
show router prefix-list
show router aspath-list
show router community-list
show router route-map
show router key-chain

# Re-run inbound policy against stored updates. Non-disruptive.
execute router clear bgp ip 198.18.10.1 soft in

# Re-run outbound policy and resend. Non-disruptive.
execute router clear bgp ip 198.18.10.1 soft out

# All peers, both directions.
execute router clear bgp all soft

# Session health and prefix counters
get router info bgp summary

# What the peer actually sent, BEFORE route-map-in.
# Requires "set soft-reconfiguration enable" on the neighbor.
get router info bgp neighbors 198.18.10.1 received-routes

# What survived and was modified, AFTER route-map-in.
get router info bgp neighbors 198.18.10.1 routes

# What we are sending, AFTER route-map-out.
get router info bgp neighbors 198.18.10.1 advertised-routes

# Full attribute detail for one prefix.
get router info bgp network 10.0.0.0/16

# Which candidate won and made it to the FIB.
get router info routing-table bgp
get router info routing-table database

get router info ospf neighbor
get router info ospf interface port2
get router info ospf database brief
get router info ospf database external

Gotcha 1: the implicit deny ate everything

Symptom: you added a route map to set local preference on one prefix. Now the neighbor advertises or receives only that prefix, or nothing at all.

Cause: the route map matched one prefix and the implicit deny discarded everything else. The same trap applies to prefix lists, access lists, AS path lists, and community lists.

Diagnose:

get router info bgp neighbors 198.18.10.1 received-routes | grep -c .
get router info bgp neighbors 198.18.10.1 routes | grep -c .

Resolution: add a high-numbered terminal rule with action permit and no match conditions.

config router route-map
    edit "RM-ISPA-IN"
        config rule
            edit 9999
                set action permit
            next
        end
    next
end

Gotcha 2: the policy is correct but nothing changed

Symptom: you edited a prefix list, the object shows the new rule, and the BGP table is unchanged.

Cause: BGP policy is applied at update time. Editing an object does not retroactively re-evaluate the Adj-RIB. Additionally, received-routes returns nothing at all unless inbound soft reconfiguration is enabled on that neighbor, which leads people to believe the peer sent nothing.

Resolution:

config router bgp
    config neighbor
        edit "198.18.10.1"
            set soft-reconfiguration enable
        next
    end
end

execute router clear bgp ip 198.18.10.1 soft in

Soft reconfiguration stores an unmodified copy of every received update, so enable it deliberately and consider disabling it on full-table peers on memory-constrained models.

Gotcha 3: distribute-list and prefix-list fighting each other

Symptom: a route map appears to be ignored, or the CLI rejects a neighbor filter you are trying to add.

Cause: a distribute list and a prefix list on the same neighbor in the same direction are mutually exclusive, since they solve the same problem with different object types. Separately, a route dropped by the distribute list, prefix list, or filter list never reaches the route map, because the route map runs last.

Diagnose:

show router bgp | grep -A 25 "edit \"198.18.10.1\""

diagnose ip router bgp level info
diagnose ip router bgp all enable
diagnose debug enable
execute router clear bgp ip 198.18.10.1 soft in
diagnose debug disable
diagnose ip router bgp level none

Resolution: standardize on prefix lists for prefix filtering and route maps for anything that needs modification. Remove the legacy distribute list rather than layering on top of it.

Gotcha 4: prepends and communities that never leave the box

Symptom: the outbound route map has set-aspath and set-community, but the peer sees an unprepended path and no communities.

Cause: two separate omissions. First, set-aspath requires an accompanying set-aspath-action. Configurations migrated from older FortiOS releases frequently lack it. Second, a FortiGate does not transmit the community attribute to a neighbor unless that neighbor has send-community set.

Resolution:

config router route-map
    edit "RM-ISPB-OUT"
        config rule
            edit 10
                set set-aspath-action prepend
                set set-aspath "65001" "65001" "65001"
            next
        end
    next
end

config router bgp
    config neighbor
        edit "198.18.20.1"
            set send-community both
        next
    end
end

Also remember that set-community without set-community-additive enable replaces every existing community on the route, silently wiping a tag another device applied.

Gotcha 5: exact-match and ge/le are not interchangeable

Symptom: a filter intended to block a /24 also blocks the covering /16, or a filter intended to block a whole block only blocks one specific length.

Cause: the two object types default in opposite directions. An access list rule defaults to exact-match disable, meaning it matches more specific prefixes too. A prefix list rule with no ge or le matches only the exact length.

Resolution: always state the intent explicitly. Write set le 32 when you mean “this block and everything inside it”, and write unset ge plus unset le when you mean “this prefix only”. Never rely on the default.

Gotcha 6: the field is called routemap here and route-map there

Symptom: a config push script works against BGP and fails against OSPF with an unknown attribute error, or a copy-pasted block is silently rejected.

Cause: FortiOS is inconsistent across routing processes. Under config router bgp the redistribution field is route-map. Under config router ospf the same concept is routemap. Similarly, OSPF’s global distribute-list-in expects a prefix list while its config distribute-list block expects an access list.

Resolution: never assume. Use set ? in the exact context before scripting it, and validate against the CLI reference for the specific FortiOS build you are deploying.

Routing objects are not six unrelated features. They are one matcher grammar plus a single mutator, wired into every routing process on the box. Once you internalize the ordered list with an implicit deny, the fixed filter order on a BGP neighbor, and the fact that the route map always runs last, FortiOS route policy stops being mysterious and starts being a config file you can review in a pull request.