VRF Route Leaking on FortiGate
A FortiGate has multiple VRFs configured. An administrator wants to allow traffic from VRF 1 to reach a server in VRF 2. What configuration is required?
⚠ Common exam trap
Many candidates confuse VRF leaking with inter-VDOM routing or assume a simple static route can bridge VRFs, but FortiGate enforces strict VRF isolation unless an explicit leak policy is configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a VRF leak policy using route maps or policy routes.
VRF leaking is the standard method to allow traffic between different VRFs on a FortiGate. This is achieved by configuring route maps or policy routes to selectively import/export routes between VRFs, enabling inter-VRF communication without merging the VRFs or using VDOMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a single VDOM and enable inter-VDOM links.
Why it's wrong here
Inter-VDOM links connect separate VDOMs, not VRFs within one VDOM. The scenario already uses multiple VRFs in a single VDOM, so no VDOM boundary exists to link. Inter-VDOM links are tempting because they solve inter-segment routing, but they apply when segmentation is implemented with VDOMs, not VRFs.
- ✗
Place both interfaces in the same VRF.
Why it's wrong here
Placing both interfaces in the same VRF removes the inter-VRF separation entirely, defeating the purpose of the segmentation. It tempts because same-VRF interfaces do route freely, which is correct when the requirement is simple connectivity and no isolation is needed; here, leaking between VRFs is the actual objective.
- ✗
Create a static route from one VRF to another.
Why it's wrong here
Static routes are installed within a single VRF's routing table; they cannot leak prefixes between VRFs. Inter-VRF traffic requires leaking routes or policy routes that specify the outgoing VRF. Static routes are tempting because they direct traffic between interfaces and subnets, but they operate inside one routing instance, not across separate routing tables.
- ✓
Configure a VRF leak policy using route maps or policy routes.
Why this is correct
VRF leak policies permit controlled route redistribution between otherwise isolated routing tables, so traffic from VRF 1 can resolve a path into VRF 2. Route maps or policy routes define which prefixes or flows are leaked, satisfying the inter-VRF reachability requirement without merging the VRFs.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.