Routing

The Network tab's Routing group has three sections:

Route table and Dynamic routing need ReadyView plugin 1.14 or later and the firewall's routing package (FRR). Routes needs plugin 1.7 or later.

#Route table

The route table lists every route the firewall knows: its own networks (Connected), Static routes, and routes learned from OSPF, BGP, RIP, or IS-IS. Filter by source with the chips at the top, or search by subnet, next hop, or interface.

Each route shows its Subnet, Next hop, Interface, Source, Metric, and whether it's In use or Not used. When two sources offer the same subnet, the one with the lower administrative distance wins; hover over a route to see its distance.

If the section says the routing service isn't running, no dynamic routing protocol is on. Use Routes to see the static routes and the firewall's basic routing table.

#Static routes

A static route sends traffic for a network to a gateway you choose, instead of the default gateway. Use one to reach a network behind another router on your LAN, for example.

#Add a static route

1. Open Network > Routes and click Add route.
2. Enter the Network, for example 10.20.0.0/16 or 2001:db8::/48.
3. Choose the Gateway that traffic goes to. The Null4 and Null6 gateways drop it.
4. Optionally add a Description. Leave Enabled ticked.
5. Click Save.

ReadyView refuses a network with host bits set (10.20.1.0/16), a network that's already routed, or a gateway of the other IP family. Add route is disabled when the firewall has no gateways.

Routes show Not in use when the firewall hasn't installed them, usually because the gateway is down, and Gateway missing when the gateway no longer exists. Gateways themselves can only be changed in the firewall's web interface (System > Gateways).

Below the routes, Routing table shows the kernel's routing table, with flags: U up, G through a gateway, H a single host, S static, B blackhole, R reject.

#Dynamic routing

Dynamic routing shares routes with other routers automatically. Turn on the protocol your network uses, tick the interfaces it runs on, and click Save changes. Each protocol card shows a status such as Off, 2 of 2 neighbours up, Running, no neighbours, or Not running.

#Set up OSPF

1. Turn OSPF on.
2. Optionally set a Router ID. Leave it empty for Automatic.
3. Under Areas, add the areas this firewall belongs to: Normal, Stub, Totally stubby, NSSA, or Totally NSSA. You can add summary routes per area.
4. In the interface table, tick Run OSPF for each interface that should form neighbours. Tick Passive for interfaces whose network you want to advertise without forming neighbours, such as user VLANs.
5. Optionally set per-interface Cost, DR priority, Point-to-point, BFD, and hello and dead timers (default 10 and 40 seconds; they must match the neighbour).
6. For authentication, tick Use MD5 authentication and set the Key ID and Passphrase.
7. Choose whether to Advertise a default route (Off, If this firewall has one, or Always), and which other routes to share.
8. Click Save changes.

#Set up BGP

1. Turn BGP on and enter the firewall's AS number.
2. Add Networks to advertise.
3. Click Add neighbour and enter the Neighbour IP, Remote AS, and optionally a description, Source interface, multihop, Hold timer, Send default route, and an MD5 password.
4. Click Save changes.

RIP (version 1 or 2, interfaces set to Send and receive or Listen only) and IS-IS (area ID, level, NET, and per-interface settings) work the same way.

#Things to know

• Allow the protocol through. ReadyView warns when no firewall rule allows OSPF (IP protocol 89) or BGP (TCP 179) on the interfaces you picked. Add a rule under Security > Firewall rules.
• Turning a protocol off drops every route learned from it. ReadyView asks you to confirm.
• Turning on BFD restarts the firewall's routing, so every neighbour drops for a few seconds.
• Passwords and keys are kept on the firewall and never shown again. ReadyView shows Set on the firewall, with Change and Keep current.
• Advanced setups stay read-only. Prefix lists, route maps, peer groups, and hand-written configuration aren't edited by ReadyView. A protocol set up beyond what ReadyView edits shows read-only with "This firewall has a more advanced … setup than ReadyView edits; change it on the firewall." ReadyView makes no changes while Enable manual config is on in the firewall's routing settings.
• One save, up to 50 changes. For more, save in parts.

After a save, ReadyView re-reads the section until the firewall has applied the change. The organization's Logs record how it ended.

#Common messages