Fortinet black logo

Administration Guide

VRF routing support

VRF routing support

VRF supports static routing, OSPF, and BGP. Other routing protocols require using VDOMs.

BGP

In this example, BGP is used to update the VRF that it is neighbors with.

The hub is configured with two neighbors connected to two interfaces. The branches are configured to match the hub, with branch networks configured to redistribute into BGP.

Policies must be created on the hub and branches to allow traffic between them.

To configure the hub:
config router bgp
    set as 65000
    config neighbor
        edit "10.101.101.2"
            set soft-reconfiguration enable
            set interface "port2"
            set remote-as 65101
            set update-source "port2"
        next
        edit "10.102.102.2"
            set soft-reconfiguration enable
            set interface "port3"
            set remote-as 65102
            set update-source "port3"
        next
    end
end
To configure branch 101:
config router bgp
    set as 65101
    config neighbor
        edit "10.101.101.1"
            set soft-reconfiguration enable
            set interface "port2"
            set remote-as 65000
            set update-source "port2"
        next
    end
    config redistribute connected
        set status enable
    end
end
To configure branch 102:
config router bgp
    set as 65102
    config neighbor
        edit "10.102.102.1"
            set soft-reconfiguration enable
            set interface "port2"
            set remote-as 65000
            set update-source "port2"
        next
    end
    config redistribute connected
        set status enable
    end
end
To verify the BGP neighbors and check the routing table on the hub:
# get router info bgp summary
BGP router identifier 192.168.0.1, local AS number 65000
BGP table version is 2
2 BGP AS-PATH entries
0 BGP community entries

Neighbor 		V	AS		MsgRcvd	MsgSent	TblVer	InQ	OutQ Up/Down	State/PfxRcd
10.101.101.2	4	65101		4		4		2		0	0	00:01:05	3
10.102.102.2	4	65102		3		3		1		0	0	00:00:30	3

Total number of neighbors 2
# get router info routing-table all
Routing table for VRF=0
Codes (…)
S*	0.0.0.0/0 [10/0] via 192.168.0.254, port1
C	10.101.101.0/24 is directly connected, port2
C	10.102.102.0/24 is directly connected, port3
C	192.168.0.0/24 is directly connected, port1
B	192.168.101.0/24 [20/0] via 10.101.101.2, port2, 00:01:25
B	192.168.102.0/24 [20/0] via 10.102.102.2, port3, 00:00:50
To configure VRF on the hub:
  1. Put the interfaces into VRF:

    config system interface
        edit port2
            set vrf 10
        next
        edit port3
            set vrf 20
        next
    end
    
  2. Restart the router to reconstruct the routing tables:

    # execute router restart
  3. Check the routing tables:

    # get router info routing-table all
    Routing table for VRF=0
    Codes (…)
    S*	0.0.0.0/0 [10/0] via 192.168.0.254, port1
    C	192.168.0.0/24 is directly connected, port1
    
    Routing table for VRF=10
    C	10.101.101.0/24 is directly connected, port2
    B	192.168.101.0/24 [20/0] via 10.101.101.2, port2, 00:02:25
    
    Routing table for VRF=20
    C	10.102.102.0/24 is directly connected, port3
    B	192.168.102.0/24 [20/0] via 10.102.102.2, port2, 00:01:50
    
  4. Check the BGP summary:

    # get router info bgp summary
    
    VRF 10 BGP router identifier 10.101.101.1, local AS number 65000
    BGP table version is 1
    2 BGP AS-PATH entries
    0 BGP community entries
    
    Neighbor 		V	AS		MsgRcvd	MsgSent	TblVer	InQ	OutQ Up/Down	State/PfxRcd
    10.101.101.2	4	65101		4		4		2		0	0	00:02:05	3
    
    Total number of neighbors 1
    
    VRF 10 BGP router identifier 10.101.101.1, local AS number 65000
    BGP table version is 1
    2 BGP AS-PATH entries
    0 BGP community entries
    
    Neighbor 		V	AS		MsgRcvd	MsgSent	TblVer	InQ	OutQ Up/Down	State/PfxRcd
    10.102.102.2	4	65102		3		3		1		0	0	00:01:30	3
    
    Total number of neighbors 1
    

OSPF

OSPF routes in VRFs work the same as BGP: the interface that OSPF is using is added to the VRF.

To configure the hub:
  1. Configure OSPF:

    config router ospf
        set router-id 1.1.1.1
        config area
            edit 0.0.0.0
            next
        end
        config ospf-interface
            edit Branch101
                set interface “port2”
                set dead-interval 40
                set hello-interval 10
            next
            edit Branch102
                set dead-interval 40
                set hello-interval 10
            next
        end
        config network
            edit 0
                set prefix 10.101.101.0 255.255.255.0
            next
            edit 0
                set prefix 10.102.102.0 255.255.255.0
            next
            edit 0
                set prefix 192.168.1.0 255.255.255.0
            next
        end
    end
  2. Put the interfaces into VRF:

    config system interface
        edit port2
            set vrf 10
        next
        edit port3
            set vrf 20
        next
    end
    
To configure branch 101:
config router ospf
    set router-id 101.101.101.101
    config area
        edit 0.0.0.0
        next
    end
    config ospf-interface
        edit HUB
            set interface port2
            set dead-interval 40
            set hello-interval 10
        next
    end
    config network
        edit 0
            set prefix 10.101.101.0 255.255.255.0
        next
        edit 0
            set prefix 192.168.101.0 255.255.255.0
        next
    end
end
To check the routing table and OSPF summary:
# get router info routing-table ospf
# get router info ospf interface

Static route

Static routes in VRFs work the same as BGP and OSPF because the interface that the static route is using is added to the VRF.

To add a VRF ID in a static route in the GUI:
  1. Configure the interface:

    1. Go to Network > Interfaces.

    2. Click Create New > Interface or Edit an existing interface.

    3. Enter a value in the VRF ID field.

    4. Configure the other settings as needed.

    5. Click OK.

  2. Add a static route to VRF. For example, using blackhole:

    1. Go to Network > Static Routes.

    2. Click Create New and select the type of static route.

    3. Enter a Subnet.

    4. In the Interface field, select Blackhole.

    5. In the VRF ID field, enter the ID created in step one.

    6. Click OK.

To add a VRF ID in a static route in the CLI:
  1. Configure the interface:

    config system interface
        edit port2
            set vrf 10
        next
    end
  2. Add a static route to the VRF. For example, using blackhole:

    config router static
        edit 3
            set dst 0.0.0.0/0
            set blackhole enable
            set vrf 10
        next
    end

A static route can also be added to the VRF when using an IPsec interface by enabling VPN ID with IPIP encapsulation. See SD-WAN segmentation over a single overlay for more information.

To add a static route to the VRF when using IPsec:
config vpn ipsec phase1-interface
    edit "vpn1"
        set interface "port2"
        set auto-discovery-receiver enable
        set encapsulation vpn-id-ipip
        set remote-gw 1.1.101.1
        set psksecret ******
    next
end
config router static
    edit 1
        set dst 10.32.0.0 255.224.0.0
        set device "vpn1"
        set vrf 10 
    next
end
To check the routing table:
# get router info routing-table static

VRF routing support

VRF routing support

VRF supports static routing, OSPF, and BGP. Other routing protocols require using VDOMs.

BGP

In this example, BGP is used to update the VRF that it is neighbors with.

The hub is configured with two neighbors connected to two interfaces. The branches are configured to match the hub, with branch networks configured to redistribute into BGP.

Policies must be created on the hub and branches to allow traffic between them.

To configure the hub:
config router bgp
    set as 65000
    config neighbor
        edit "10.101.101.2"
            set soft-reconfiguration enable
            set interface "port2"
            set remote-as 65101
            set update-source "port2"
        next
        edit "10.102.102.2"
            set soft-reconfiguration enable
            set interface "port3"
            set remote-as 65102
            set update-source "port3"
        next
    end
end
To configure branch 101:
config router bgp
    set as 65101
    config neighbor
        edit "10.101.101.1"
            set soft-reconfiguration enable
            set interface "port2"
            set remote-as 65000
            set update-source "port2"
        next
    end
    config redistribute connected
        set status enable
    end
end
To configure branch 102:
config router bgp
    set as 65102
    config neighbor
        edit "10.102.102.1"
            set soft-reconfiguration enable
            set interface "port2"
            set remote-as 65000
            set update-source "port2"
        next
    end
    config redistribute connected
        set status enable
    end
end
To verify the BGP neighbors and check the routing table on the hub:
# get router info bgp summary
BGP router identifier 192.168.0.1, local AS number 65000
BGP table version is 2
2 BGP AS-PATH entries
0 BGP community entries

Neighbor 		V	AS		MsgRcvd	MsgSent	TblVer	InQ	OutQ Up/Down	State/PfxRcd
10.101.101.2	4	65101		4		4		2		0	0	00:01:05	3
10.102.102.2	4	65102		3		3		1		0	0	00:00:30	3

Total number of neighbors 2
# get router info routing-table all
Routing table for VRF=0
Codes (…)
S*	0.0.0.0/0 [10/0] via 192.168.0.254, port1
C	10.101.101.0/24 is directly connected, port2
C	10.102.102.0/24 is directly connected, port3
C	192.168.0.0/24 is directly connected, port1
B	192.168.101.0/24 [20/0] via 10.101.101.2, port2, 00:01:25
B	192.168.102.0/24 [20/0] via 10.102.102.2, port3, 00:00:50
To configure VRF on the hub:
  1. Put the interfaces into VRF:

    config system interface
        edit port2
            set vrf 10
        next
        edit port3
            set vrf 20
        next
    end
    
  2. Restart the router to reconstruct the routing tables:

    # execute router restart
  3. Check the routing tables:

    # get router info routing-table all
    Routing table for VRF=0
    Codes (…)
    S*	0.0.0.0/0 [10/0] via 192.168.0.254, port1
    C	192.168.0.0/24 is directly connected, port1
    
    Routing table for VRF=10
    C	10.101.101.0/24 is directly connected, port2
    B	192.168.101.0/24 [20/0] via 10.101.101.2, port2, 00:02:25
    
    Routing table for VRF=20
    C	10.102.102.0/24 is directly connected, port3
    B	192.168.102.0/24 [20/0] via 10.102.102.2, port2, 00:01:50
    
  4. Check the BGP summary:

    # get router info bgp summary
    
    VRF 10 BGP router identifier 10.101.101.1, local AS number 65000
    BGP table version is 1
    2 BGP AS-PATH entries
    0 BGP community entries
    
    Neighbor 		V	AS		MsgRcvd	MsgSent	TblVer	InQ	OutQ Up/Down	State/PfxRcd
    10.101.101.2	4	65101		4		4		2		0	0	00:02:05	3
    
    Total number of neighbors 1
    
    VRF 10 BGP router identifier 10.101.101.1, local AS number 65000
    BGP table version is 1
    2 BGP AS-PATH entries
    0 BGP community entries
    
    Neighbor 		V	AS		MsgRcvd	MsgSent	TblVer	InQ	OutQ Up/Down	State/PfxRcd
    10.102.102.2	4	65102		3		3		1		0	0	00:01:30	3
    
    Total number of neighbors 1
    

OSPF

OSPF routes in VRFs work the same as BGP: the interface that OSPF is using is added to the VRF.

To configure the hub:
  1. Configure OSPF:

    config router ospf
        set router-id 1.1.1.1
        config area
            edit 0.0.0.0
            next
        end
        config ospf-interface
            edit Branch101
                set interface “port2”
                set dead-interval 40
                set hello-interval 10
            next
            edit Branch102
                set dead-interval 40
                set hello-interval 10
            next
        end
        config network
            edit 0
                set prefix 10.101.101.0 255.255.255.0
            next
            edit 0
                set prefix 10.102.102.0 255.255.255.0
            next
            edit 0
                set prefix 192.168.1.0 255.255.255.0
            next
        end
    end
  2. Put the interfaces into VRF:

    config system interface
        edit port2
            set vrf 10
        next
        edit port3
            set vrf 20
        next
    end
    
To configure branch 101:
config router ospf
    set router-id 101.101.101.101
    config area
        edit 0.0.0.0
        next
    end
    config ospf-interface
        edit HUB
            set interface port2
            set dead-interval 40
            set hello-interval 10
        next
    end
    config network
        edit 0
            set prefix 10.101.101.0 255.255.255.0
        next
        edit 0
            set prefix 192.168.101.0 255.255.255.0
        next
    end
end
To check the routing table and OSPF summary:
# get router info routing-table ospf
# get router info ospf interface

Static route

Static routes in VRFs work the same as BGP and OSPF because the interface that the static route is using is added to the VRF.

To add a VRF ID in a static route in the GUI:
  1. Configure the interface:

    1. Go to Network > Interfaces.

    2. Click Create New > Interface or Edit an existing interface.

    3. Enter a value in the VRF ID field.

    4. Configure the other settings as needed.

    5. Click OK.

  2. Add a static route to VRF. For example, using blackhole:

    1. Go to Network > Static Routes.

    2. Click Create New and select the type of static route.

    3. Enter a Subnet.

    4. In the Interface field, select Blackhole.

    5. In the VRF ID field, enter the ID created in step one.

    6. Click OK.

To add a VRF ID in a static route in the CLI:
  1. Configure the interface:

    config system interface
        edit port2
            set vrf 10
        next
    end
  2. Add a static route to the VRF. For example, using blackhole:

    config router static
        edit 3
            set dst 0.0.0.0/0
            set blackhole enable
            set vrf 10
        next
    end

A static route can also be added to the VRF when using an IPsec interface by enabling VPN ID with IPIP encapsulation. See SD-WAN segmentation over a single overlay for more information.

To add a static route to the VRF when using IPsec:
config vpn ipsec phase1-interface
    edit "vpn1"
        set interface "port2"
        set auto-discovery-receiver enable
        set encapsulation vpn-id-ipip
        set remote-gw 1.1.101.1
        set psksecret ******
    next
end
config router static
    edit 1
        set dst 10.32.0.0 255.224.0.0
        set device "vpn1"
        set vrf 10 
    next
end
To check the routing table:
# get router info routing-table static