Technical Tip: Configuring link-monitor with route leaking in multi-VRF deployments
| Description | This article describes how to configure a link-monitor in a multi-VRF environment. |
| Scope | FortiGate. |
| Solution | To configure a link-monitor using static routes in a multi-VRF environment with route leaking, the FortiGate must be configured to allow inter-VRF connectivity. This is achieved using inter-VDOM links within a single VDOM. Inter-VDOM links are enabled using one of the following methods:
config system global set single-vdom-npuvlink enable end
Note: software inter-VDOM links can have a performance impact, particularly in environments with heavy traffic. config system vdom-link edit "link-10-20-" next end Configuring a vdom-link creates two interfaces with a vdom-link type: config system interface edit "link-10-20-0" set vdom "root" set type vdom-link set snmp-index 20 next edit "link-10-20-1" set vdom "root" set type vdom-link set snmp-index 21 next end
config system global set vdom-mode multi-vdom end
Configure VRF route leaking: Once an inter-vdom link is available, configure VRF route leaking as needed, referencing the following documentation:
Configuring the link monitor:
This setting allows the same subnet to be configured on different interfaces. Note that this is also part of the route leaking configuration steps. config system settings set allow-subnet-overlap enable end
Define the VDOM link interfaces and assign them to different VRFs. Each interface must have an IP address within the same subnet. config system interface edit "npu0_vlink0" set vdom "root" set vrf 10 set ip 10.20.20.1 255.255.255.252 set type physical set snmp-index 35 next edit "npu0_vlink1" set vdom "root" set vrf 20 set ip 10.20.20.2 255.255.255.252 set type physical set snmp-index 36 next end
A firewall policy is required to allow traffic from the inter-VDOM link toward the WAN interface. config firewall policy edit <index> set srcintf "npu0_vlink0" set dstintf "wan1" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" set nat enable next end
Once routing and policies are in place, the link-monitor can be created. The source interface, source IP, and gateway IP must match the VRF and inter-VDOM link configuration. config system link-monitor edit "lkmt_vrf20" set srcintf "npu0_vlink1" set server "8.8.4.4" set gateway-ip 10.20.20.1 set source-ip 10.20.20.2 set update-cascade-interface disable set update-static-route disable next end
Use the following command to verify the operational status of the link-monitor: diagnose sys link-monitor status Expected output example: diagnose sys link-monitor status Link Monitor: 1, Status: alive, Server num(1), cfg_version=0 HA state: local(alive), shared(alive) Flags=0x1 init, Create time: Tue Jan 13 21:25:48 2026 Source interface: npu0_vlink1 (34) VRF: 0 Source IP: 10.20.20.2 Gateway: 10.20.20.1 Interval: 500 ms Service-detect: disable Diffservcode: 000000 Class-ID: 0 Transport-Group: 0 Class-ID: 0 Peer: 8.8.4.4(8.8.4.4) Source IP(10.20.20.2) Route: 10.20.20.2->8.8.4.4/32, gwy(10.20.20.1) protocol: ping, state: alive Latency(Min/Max/Avg): 7.099/7.289/7.153 ms Jitter(Min/Max/Avg): 0.000/0.119/0.041 ms Packet lost: 0.000% MOS: 4.401 Number of out-of-sequence packets: 0 Fail Times(0/5) Packet sent: 17203, received: 9254, Sequence(sent/rcvd/exp): 17204/17203/17204 Notes:
|
