The utility's routing table contains a static default route (0.0.0.0/0.0.0.0), a static route for 172.16.0.0/16 covering the whole substation network, and a static route for 172.16.8.0/22 covering one regional cluster of substations. A packet is destined for 172.16.8.100. Which route does the FortiGate select?
Select an answer to reveal the explanation.
Short Explanation
All three routes technically lead toward 172.16.8.100, but only one of them narrows the neighborhood down the most. The FortiGate always takes the most specific address it has on file, so the /22 wins over both the /16 and the default route.
Full Explanation
Longest-prefix match is evaluated before administrative distance or priority ever come into play: among all routes whose network covers a destination address, the one with the longest subnet mask — the most specific match — is selected, regardless of how the other candidates compare on distance or priority. Here, 172.16.8.100 falls within the default route, the /16, and the /22 simultaneously, but the /22 is the most specific of the three and is the one installed for that destination. The idea that broader summary routes are preferred for "stability" has no basis in how FortiOS selects routes — specificity, not summarization, drives the decision. The default route being a catch-all is true in general, but it is only ever used when nothing more specific matches, which is not the case here since two more specific routes exist. Priority is a tool for breaking ties between routes of the same prefix length and distance; it never overrides prefix length itself, so the fourth option describes the decision process backwards. A quick way to confirm this is to check the routing table's route lookup for 172.16.8.100 specifically and see which entry is marked selected.