VRF Route Leaking on FortiGate
A FortiGate is configured with two VRF instances (VRF1 and VRF2). The admin needs to allow traffic from VRF1 to reach a server in VRF2. The server is directly connected to the FortiGate on an interface in VRF2. What configuration is required?
Quick Answer
The correct answer is to use VRF route leaking with route maps to export necessary routes between VRFs. This is required because VRFs create isolated routing tables by default, meaning traffic from VRF1 cannot reach a server directly connected to an interface in VRF2 without explicit route sharing. VRF route leaking on FortiGate allows you to selectively import or export routes between VRF instances using route maps, which control which prefixes are shared and can apply attributes like next-hop or metric modifications. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of multi-VRF segmentation and inter-VRF communication, often appearing in scenario-based questions where a directly connected server in one VRF must be reachable from another. A common trap is assuming static routes alone suffice—without route leaking, the VRFs remain isolated even with static entries. Memory tip: think of VRFs as separate houses; route leaking is the door you build with a route map as the key that decides who enters.
⚠ Common exam trap
Candidates often assume a firewall policy with source and destination VRF selection is sufficient to allow inter-VRF traffic, but they overlook that routing must first be established via route leaking before any policy can be applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use VRF route leaking with route maps to export necessary routes between VRFs
B is correct because VRF route leaking is the standard method to enable communication between separate VRF instances on a FortiGate. This involves using route maps to selectively export routes from VRF2 into VRF1, allowing traffic from VRF1 to reach the server in VRF2. Without route leaking, VRFs are isolated by default, and no other mechanism (like static routes or firewall policies alone) can bridge the routing table separation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add both VRFs to the same VDOM
Why it's wrong here
VRFs can be within the same VDOM, but still isolated without route leaking.
- ✓
Use VRF route leaking with route maps to export necessary routes between VRFs
Why this is correct
Route leaking allows redistribution of routes between VRFs, enabling inter-VRF communication.
- ✗
Configure a static route in VRF1 pointing to the server's IP via the VRF2 interface
Why it's wrong here
Static routes in one VRF cannot point to an interface in another VRF without leaking.
- ✗
Configure a firewall policy with source VRF1 and destination VRF2
Why it's wrong here
Firewall policies work within the same VRF by default; they cannot directly forward between VRFs without route leaking.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate has multiple VRFs configured. An administrator wants to allow traffic from VRF 1 to reach a server in VRF 2. What configuration is required?
medium- A.Use a single VDOM and enable inter-VDOM links.
- B.Place both interfaces in the same VRF.
- C.Create a static route from one VRF to another.
- ✓ D.Configure a VRF leak policy using route maps or policy routes.
Why D: VRF leaking is the standard method to allow traffic between different VRFs on a FortiGate. This is achieved by configuring route maps or policy routes to selectively import/export routes between VRFs, enabling inter-VRF communication without merging the VRFs or using VDOMs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.