Fortinet black logo

Administration Guide

Route leaking between VRFs

Route leaking between VRFs

This feature provides generic route leaking capabilities between locally defined VRFs (VRF-lite). If VRF leaking is not configured, VRFs are isolated.

In this example, interface npu0_vlink0 belongs to VRF 10 and is used to leak 1.2.2.2/32 from VRF10 to VRF20, and interface npu0_vlink1 belongs to VRF 20 and is used to leak 172.28.1.0/24 from VRF20 to VRF10. So, VRF10 can see 172.28.1.0/24, and VRF20 can see 1.2.2.2/32.

To configure VRF leaking:
  1. Configure the prefix list and route map to filter what will be leaked:
    config router prefix-list
        edit "1"
            config rule
                edit 1
                    set prefix 1.2.2.2 255.255.255.255
                next
            end
        next
        edit "2"
            config rule
                edit 1
                    set prefix 172.28.1.0 255.255.255.0
                next
            end
        next
    end
    config router route-map
        edit "from10"
            config rule
                edit 1
                    set match-ip-address "1"
                next
            end
        next
        edit "from20"
            config rule
                edit 1
                    set match-ip-address "2"
                next
            end
        next
    end
  2. Configure the VDOM link interfaces for the leaking and routing:
    config system interface
        edit "npu0_vlink0"
            set vdom "root"
            set vrf 10
            set ip 172.16.201.1 255.255.255.0
            set allowaccess ping https ssh snmp http
        next
        edit "npu0_vlink1"
            set vdom "root"
            set vrf 20
            set ip 172.16.201.2 255.255.255.0
            set allowaccess ping https ssh snmp http telnet
        next
    end
  3. Configure the BGP VRF leak:
    config router bgp
        set as 44
        set router-id 4.4.4.4
        config neighbor
            edit "172.16.200.1"
                set soft-reconfiguration enable
                set remote-as 11
                set update-source "port1"
            next
            edit "172.16.202.1"
                set soft-reconfiguration enable
                set remote-as 22
                set update-source "port3"
            next
        end
        config vrf-leak
            edit "10"
                config target
                    edit "20"
                        set route-map "from10"
                        set interface "npu0_vlink0"
                    next
                end
            next
            edit "20"
                config target
                    edit "10"
                        set route-map "from20"
                        set interface "npu0_vlink1"
                    next
                end
            next
        end
    end
  4. Confirm that the filtered routed leaked as expected:
    # get router info routing-table all
    Routing table for VRF=10
    B       1.1.1.1/32 [20/0] via 172.16.200.1, port1, 01:03:16
    B       1.2.2.2/32 [20/0] via 172.16.200.1, port1, 01:03:16
    B       172.28.1.0/24 [20/0] via 172.16.201.2, npu0_vlink0, 00:00:17   <<<<<<<<<<<<<<Leaked into VRF10 from VRF20
    
    Routing table for VRF=20
    B       1.2.2.2/32 [20/0] via 172.16.201.1, npu0_vlink1, 00:00:15   <<<<<<<<<<<<<<Leaked into VRF 20 from VRF10
    B       172.28.1.0/24 [20/0] via 172.16.202.1, port3, 01:03:16
    B       172.28.2.0/24 [20/0] via 172.16.202.1, port3, 01:03:16

Route leaking between VRFs

This feature provides generic route leaking capabilities between locally defined VRFs (VRF-lite). If VRF leaking is not configured, VRFs are isolated.

In this example, interface npu0_vlink0 belongs to VRF 10 and is used to leak 1.2.2.2/32 from VRF10 to VRF20, and interface npu0_vlink1 belongs to VRF 20 and is used to leak 172.28.1.0/24 from VRF20 to VRF10. So, VRF10 can see 172.28.1.0/24, and VRF20 can see 1.2.2.2/32.

To configure VRF leaking:
  1. Configure the prefix list and route map to filter what will be leaked:
    config router prefix-list
        edit "1"
            config rule
                edit 1
                    set prefix 1.2.2.2 255.255.255.255
                next
            end
        next
        edit "2"
            config rule
                edit 1
                    set prefix 172.28.1.0 255.255.255.0
                next
            end
        next
    end
    config router route-map
        edit "from10"
            config rule
                edit 1
                    set match-ip-address "1"
                next
            end
        next
        edit "from20"
            config rule
                edit 1
                    set match-ip-address "2"
                next
            end
        next
    end
  2. Configure the VDOM link interfaces for the leaking and routing:
    config system interface
        edit "npu0_vlink0"
            set vdom "root"
            set vrf 10
            set ip 172.16.201.1 255.255.255.0
            set allowaccess ping https ssh snmp http
        next
        edit "npu0_vlink1"
            set vdom "root"
            set vrf 20
            set ip 172.16.201.2 255.255.255.0
            set allowaccess ping https ssh snmp http telnet
        next
    end
  3. Configure the BGP VRF leak:
    config router bgp
        set as 44
        set router-id 4.4.4.4
        config neighbor
            edit "172.16.200.1"
                set soft-reconfiguration enable
                set remote-as 11
                set update-source "port1"
            next
            edit "172.16.202.1"
                set soft-reconfiguration enable
                set remote-as 22
                set update-source "port3"
            next
        end
        config vrf-leak
            edit "10"
                config target
                    edit "20"
                        set route-map "from10"
                        set interface "npu0_vlink0"
                    next
                end
            next
            edit "20"
                config target
                    edit "10"
                        set route-map "from20"
                        set interface "npu0_vlink1"
                    next
                end
            next
        end
    end
  4. Confirm that the filtered routed leaked as expected:
    # get router info routing-table all
    Routing table for VRF=10
    B       1.1.1.1/32 [20/0] via 172.16.200.1, port1, 01:03:16
    B       1.2.2.2/32 [20/0] via 172.16.200.1, port1, 01:03:16
    B       172.28.1.0/24 [20/0] via 172.16.201.2, npu0_vlink0, 00:00:17   <<<<<<<<<<<<<<Leaked into VRF10 from VRF20
    
    Routing table for VRF=20
    B       1.2.2.2/32 [20/0] via 172.16.201.1, npu0_vlink1, 00:00:15   <<<<<<<<<<<<<<Leaked into VRF 20 from VRF10
    B       172.28.1.0/24 [20/0] via 172.16.202.1, port3, 01:03:16
    B       172.28.2.0/24 [20/0] via 172.16.202.1, port3, 01:03:16