Default Routes and Dynamic Routing on Cloud-Managed Fireboxes

Overview

A default route (0.0.0.0/0) defines where a cloud-managed Firebox sends traffic when no more specific route exists.

A Firebox can learn a default route from:

An external interface (DHCP or PPPoE)
A static route
A dynamic routing protocol (OSPF, BGP, or RIP)

Because the Firebox can learn default routes from multiple sources, multiple default routes can exist. This topic describes how the Firebox selects a default route.

Default Route Selection

When multiple default routes exist, the Firebox selects the route based on:

Administrative Distance (AD) — This value indicates how much the Firebox trusts a route source. The value is not a score; it is a ranking. When multiple routes to the same destination exist, the Firebox prefers the route with the lowest administrative distance.
Metric (Distance) — This value indicates the priority of a route with the same administrative distance as another route. The Firebox evaluates the metric value only when routes have the same AD. The Firebox prefers the route with the lowest metric.

For static routes, the configured Distance value is the route's administrative distance (AD).

The Firebox uses these default AD values for each route source:

Interface or static route: 1
BGP: 20
OSPF: 110
RIP: 120

Interface Default Route Metrics

The Firebox assigns default metrics to external interfaces based on whether they use single-WAN or multi-WAN configurations. If the Firebox is configured with a multi-WAN action, the Firebox automatically assigns metric values to interface default routes based on the multi‑WAN method. These metrics determine priority among interface routes when their AD is the same.

The Firebox assigns these metric values to interface routes:

Single interface: 5
Multi-WAN (Routing Table, Overflow, or Round-Robin methods): 5 (all interfaces)
Multi-WAN (Failover method): 10 + interface order (10, 11, 12, ...)
Interface not in multi-WAN: 20

If an interface in a multi-wan configuration is down, the route is removed.

These metrics only determine priority between interface routes. They do not affect route selection against dynamic routes.

For more information about multi-WAN behavior, go to SD-WAN Details.

Interaction with Dynamic Routing

Dynamic routing protocols can advertise a default route, but the Firebox does not use metrics to select between routes with different administrative distances.

For example:

Interface route — AD 1, metric 5
OSPF route — AD 110, metric 10

In this example, the Firebox selects the interface route because it has the lower administrative distance.

Configure Preference for a Dynamic Default Route

Because interface routes typically have a lower administrative distance, the Firebox usually prefers them over routes learned through dynamic routing. To make the Firebox select a dynamically learned default route instead of a lower‑priority interface or static route, you can use one of these methods:

Increase the administrative distance of the interface or static route so that the dynamically learned route has a lower administrative distance and becomes the preferred default route.
Disable the interface-learned default route to remove the automatically learned default route from the routing table and allow the Firebox to use a default route learned through dynamic routing.

Do not rely on metrics alone to influence route selection. For more information, go to About Dynamic Routing and Protocols for Cloud-Managed Fireboxes.

Summary of Default Route Types

This table summarizes the default administrative distance and typical metric behavior for each type of default route source.

Route Source	Default AD	Default Metric Behavior
Interface (DHCP/PPPoE)	1	5 (or Multi-WAN dependent)
Static route	1	Manually configured.
BGP	20	Protocol-defined.
OSPF	110	Protocol-defined.
RIP	120	Protocol-defined.