Quick Answer

The correct actions are to use `set next-hop-self` on the BGP neighbor in each VRF or to configure route leaking via `config router vrf` with the `leak-route` command. BGP, by default, treats each VRF as a separate routing table and will not advertise routes between them without explicit route leaking; the `next-hop-self` option forces the FortiGate to become the next hop, which combined with BGP multipath in specific topologies, effectively leaks routes across VRFs. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of VRF segmentation and BGP route redistribution, often appearing as a trick where candidates mistakenly try to import routes or adjust local preference. A common trap is assuming BGP automatically shares routes between VRFs, but remember that VRFs are isolated by design. Memory tip: think “VRF isolation means no automatic BGP sharing—leak it with `next-hop-self` or `leak-route`.”