Inter-VRF Communication: Route Leak + Firewall Policy Required
A FortiGate is configured with multiple VRFs to segregate traffic from different departments. The administrator needs to allow the Finance VRF to access a shared printer in the default VRF. Which TWO steps are required to enable inter-VRF communication?
Quick Answer
The answer is that you must both create a firewall policy between the VRF interfaces and configure a route leak or inter-VRF policy route. This is required because VRFs create separate virtual routing tables, so traffic from the Finance VRF cannot reach the default VRF without a route leak to bridge the routing tables, and the firewall policy is needed to explicitly permit that traffic between the isolated domains. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding that inter-VRF communication is a two-step process: routing and security, and a common trap is thinking that simply adding a firewall policy is enough without also leaking routes. Remember the memory tip: "Leak the route, then permit the shoot" — routing must come first, then the firewall policy to allow the traffic.
⚠ Common exam trap
Watch out — candidates often assume a firewall policy alone is sufficient for inter-VRF traffic, forgetting that the source VRF must have a route to the destination subnet, which requires explicit route leaking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a leak route from the Finance VRF to the default VRF for the printer's subnet
Route leaking is required to make the printer's subnet reachable from the Finance VRF. Without a leak route, the Finance VRF has no route to the printer in the default VRF, so traffic cannot be forwarded even if a firewall policy permits it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure OSPF to redistribute routes between VRFs
Why it's wrong here
OSPF does not automatically redistribute between VRFs; you need explicitly configured leak routes.
- ✗
Place both the Finance and default VRF interfaces into the same zone
Why it's wrong here
Zones do not handle inter-VRF routing.
- ✗
Assign the printer's IP address to an interface in the Finance VRF
Why it's wrong here
That would move the printer, not enable inter-VRF communication.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You have configured VRF on a FortiGate with two VRFs: VRF 1 for guest traffic and VRF 2 for corporate traffic. You want to allow limited communication from guests to a corporate DNS server. What is the correct configuration step?
hard- A.Create a firewall policy from VRF 1 to VRF 2 allowing DNS traffic
- B.Enable 'set allow-vrf' on the DNS server's interface
- ✓ C.Configure route leaking between VRF 1 and VRF 2 for the DNS server's IP
- D.Place the DNS server in a management VDOM and use inter-VDOM links
Why C: VRF isolation by default prevents traffic from crossing between VRFs. To allow a guest in VRF 1 to reach a corporate DNS server in VRF 2, you must leak the DNS server's route from VRF 2 into VRF 1. This is achieved by configuring route leaking (e.g., using route maps or VRF route leaking on FortiGate), which installs the DNS server's IP prefix into the guest VRF's routing table, enabling reachability without breaking VRF separation for other traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.