The utility has summarized several small substation subnets into a single /20 static route advertised toward its upstream provider. One of the smaller subnets inside that /20 is not actually in use yet. What is the purpose of adding a blackhole static route for that specific unused subnet on the FortiGate?
Select an answer to reveal the explanation.
Short Explanation
A blackhole route is like a dead-end sign for an address that doesn't really exist yet — instead of traffic wandering back out to the internet and bouncing around looking for a real destination, the FortiGate just quietly drops it right there.
Full Explanation
When a summary route like a /20 is advertised upstream, any traffic arriving for an unused sub-block inside it would otherwise fall through to a less specific route — often a default route — and be sent back out toward the internet, only to bounce between the utility's edge and its upstream provider in a routing loop, wasting bandwidth and generating noise. A blackhole route installs a more specific entry for that exact sub-block whose action is to discard matching packets immediately, cleanly absorbing traffic for addresses that are summarized but not yet assigned. It has nothing to do with encryption speed, which is governed by VPN and hardware-offload settings, not routing entries. It also does not communicate anything to the upstream ISP automatically — announcing or withdrawing the /20 itself is a separate routing-protocol or provider-coordination action. And a blackhole entry stays a static route; it is not a mechanism for converting anything into a dynamic OSPF route. To verify the fix worked, send a test packet to an address inside the unused sub-block and confirm it is dropped locally rather than appearing in traceroute hops toward the upstream provider.