BGP Route Leaking Between VRFs on FortiGate
A FortiGate is configured with multiple VRFs. An administrator notices that routes from VRF A are not being advertised to VRF B via BGP, even though the BGP configuration is correct. Which TWO actions could resolve this issue?
Quick Answer
The correct actions are to use `set next-hop-self` on the BGP neighbor in each VRF or to configure route leaking via `config router vrf` with the `leak-route` command. BGP, by default, treats each VRF as a separate routing table and will not advertise routes between them without explicit route leaking; the `next-hop-self` option forces the FortiGate to become the next hop, which combined with BGP multipath in specific topologies, effectively leaks routes across VRFs. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of VRF segmentation and BGP route redistribution, often appearing as a trick where candidates mistakenly try to import routes or adjust local preference. A common trap is assuming BGP automatically shares routes between VRFs, but remember that VRFs are isolated by design. Memory tip: think “VRF isolation means no automatic BGP sharing—leak it with `next-hop-self` or `leak-route`.”
⚠ Common exam trap
Many candidates confuse BGP session-level settings (like enforce-first-as or damping) with VRF route leaking mechanisms, assuming any BGP tweak can fix cross-VRF issues, when in fact explicit VRF export/import configuration is required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a route leak from VRF A to VRF B under config router vrf
Configuring a route leak from VRF A to VRF B under 'config router vrf' explicitly allows routes to be imported/exported between VRFs using route targets, which is required for cross-VRF BGP route advertisement. Option E is correct because 'set next-hop-self' on the BGP neighbor in each VRF ensures that the next hop is reachable from the receiving VRF, preventing next-hop unreachability issues that can block route advertisement.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured with multiple virtual routers (VRFs). The administrator wants to allow communication between two VRFs using a firewall policy. Which type of interface is required for the policy?
easy- ✓ A.VDOM link
- B.VLAN subinterface
- C.Loopback interface
- D.Virtual-wire pair
Why A: A VDOM link is a virtual interface that connects two VDOMs (Virtual Domains) and inherently supports routing between different VRFs (Virtual Routing and Forwarding instances) within a FortiGate. When a firewall policy is applied to a VDOM link, it can control traffic flowing between the two VRFs, as the link itself is a Layer 3 interface that belongs to both VDOMs and can be assigned to different VRFs on each side. This is the only interface type that natively allows inter-VRF communication with firewall policy enforcement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.