Skip to main content
Judbe
Judbe
Visitor III
March 10, 2025
Question

OSPF Redistribution Issue with Multiple VRFs

  • March 10, 2025
  • 6 replies
  • 1605 views

Hello!
I have multiple VRFs configured on a Fortigate device and I can see that OSPF creates a separate process per VRF:

 

OSPF Router with ID (10.10.10.10) (Process ID 1, VRF 1) OSPF Router with ID (10.10.10.10) (Process ID 2, VRF 2) OSPF Router with ID (10.10.10.10) (Process ID 3, VRF 3) ...

 

 

Each VRF should be isolated but when enabling "Redistribute Connected", OSPF starts advertising all directly connected networks across all VRFs, causing routing loops.

I have tried using route-maps to filter the redistribution, but the issue persists. It seems that Fortigate treats redistribution as global per VDOM rather than per OSPF process/VRF.

Questions:
* Is there a way to ensure that "Redistribute Connected" only applies within its respective VRF and does not affect other VRFs?
* If this is expected behavior, what is the recommended best practice for redistributing directly connected networks while maintaining VRF isolation?

Thanks in advance for your help!

6 replies

ebilcari
Staff
ebilcari
Staff
March 12, 2025

Currently, FGT has some limitations in configuring separate OSPF instances for each VRF. To achieve fully independent OSPF configurations, you should consider using VDOMs.

Emirjon
    palrami
    palrami
    New Member
    November 1, 2025

    Hello, are you able to share your config also if you found solution 

    funkylicious
    SuperUser
    funkylicious
    SuperUser
    November 1, 2025

    one option would be to create a route-map that matches the prefix and vrf and use it under redistribute.

    "jack of all trades, master of none"
    palrami
    palrami
    New Member
    November 1, 2025

    Thank you, i have the following configurations but ospf didnt come, basically _leak0 and _leak1 belongs to different vrfs, i saw error about duplicate router id, i was wondering if you can share your ospf configurations

     

     

    HUB1 (ospf) # show
    config router ospf
    config area
    edit 0.0.0.0
    next
    end
    config ospf-interface
    edit "cevrf"
    set interface "vrf10_leak1"
    set dead-interval 40
    set hello-interval 10
    set network-type point-to-point
    next
    edit "pevrf"
    set interface "vrf10_leak0"
    set dead-interval 40
    set hello-interval 10
    set network-type point-to-point
    next
    end
    config network
    edit 1
    set prefix 10.200.255.20 255.255.255.254
    next

    funkylicious
    SuperUser
    funkylicious
    SuperUser
    November 1, 2025

    i dont have a working config, i just shared an idea i had about the redistribution.

    as for the ospf with intfs in diff vrfs, it should work - https://community.fortinet.com/t5/FortiGate/Technical-Note-OSPF-Support-for-multiple-virtual-routing-and/ta-p/192714 

    is the router-id duplicate on FGT on the remote devices ?

    "jack of all trades, master of none"
    hamanka6
    hamanka6
    New Member
    November 2, 2025

    Maybe I'm missing something from the way you've described your scenario, but why would you have to modify the ASR config? Your OSPF process numbers don't have to match between peers, is that where you were seeing an issue? You should be able to configure the 4500 with OSPF-1 in VRF-A and OSPF-2 in VRF-B, and have both of those OSPF processes peer with OSPF-3 on the ASR.

    Judbe
    JudbeAuthor
    Visitor III
    November 3, 2025

    Hi!

    As @ebilcari wrote: “FGT has some limitations in configuring separate OSPF instances for each VRF. To achieve fully independent OSPF configurations, you should consider using VDOMs.”

    And that’s true. Between VDOMs work without any issue, but not within the same VDOM.

    What worked for us was to advertise the networks of each VRF in a different OSPF area (within the same VDOM). Everything else we tested eventually caused loops.

    Example:

    VRF 1 — networks: 10.10.10.0/24, 100.100.100.0/24 — area 1

    VRF 2 — network: 20.20.20.0/24 — area 2
    ...

      ElwinBERRAR
      ElwinBERRAR
      Explorer III
      November 3, 2025

      Yeah, that’s a known limitation on FortiGate. When you enable “redistribute connected” inside a VDOM, it’s applied globally, not per VRF. That’s why connected routes from other VRFs get advertised and cause loops.

      The cleanest way to keep things separate is to use one VDOM per VRF. If that’s not possible, your idea of using different OSPF areas for each VRF is probably the safest workaround.

      Toshi_Esumi
      SuperUser
      Toshi_Esumi
      SuperUser
      November 3, 2025

      If you separate those VRFs by individual VDOM, you no longer need VRFs. Because those VDOMs are separate routers. To me, that's the safest.

      Toshi

      Terms & ConditionsAccessibility statement