How is traffic routed on FortiSwitch?

In a Fortinet Security Fabric environment, a FortiSwitch is typically managed by a FortiGate via the FortiLink protocol. This centralized management allows an administrator to configure Layer 3 routing capabilities directly on the FortiSwitch from the FortiGate interface. This is achieved by creating Switch Virtual Interfaces (SVIs) on the FortiSwitch, which enables the switch to perform inter-VLAN routing at hardware-accelerated speeds. The FortiGate acts as the control plane for configuration, while the FortiSwitch performs the actual data plane routing operations.

A. Hardware-based routing is offloaded to specialized ASICs (Application-Specific Integrated Circuits) for high-speed packet forwarding, while the CPU handles control plane tasks like routing protocol updates.

B. The Forwarding Information Base (FIB) is the table used for forwarding decisions. In hardware-accelerated switches, the FIB is programmed into the hardware (ASIC) for fast lookups, not consulted after a separate hardware table.

C. ASIC hardware routing is agnostic to the route's origin. It forwards packets based on the destination entries in its forwarding table, whether those routes were learned statically or through dynamic routing protocols.

1. FortiSwitch FortiLink Guide 7.6.0, Configuring the FortiSwitch interfaces > Creating a new FortiSwitch VLAN interface, Page 19: "You can configure a FortiSwitch VLAN interface to provide Layer-3 routing between FortiSwitch units in the same FortiLink." This document explicitly states that Layer 3 routing is configured on a FortiSwitch under the management of a FortiGate.

2. FortiSwitch Standalone Mode 7.6.0 Administration Guide, Routing > Static routing, Page 101: This guide details the underlying Layer 3 capabilities of the FortiSwitch, including static and dynamic routing, which are the features managed by FortiGate in FortiLink mode.

3. Fortinet Product Datasheet: FortiSwitch Secure Access Series, Highlights section: The datasheet frequently mentions "FortiASIC" processors that provide "wire-speed performance." This confirms that packet forwarding (the data plane of routing) is handled by dedicated hardware, not the main CPU, directly contradicting option A.