VRF access to Internet

Hello @Mnz160889  , 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

   Fortinet Community Team 

You would need to setup a vdom-link (even if you are not using vdoms).  For the vdom link you can create vlan sub-interfaces and assign them to the correct VRF.  This document has an overview of how it works:

https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/342655/route-leaking-between-multiple-vrfs

You will probably want to allow over-lapping subnets so the vdom links can be in the same subnet similar to this:

 By default, it will not be allowed.

 

# config system setting

set allow-subnet-overlap enable

 

# config system interface

    edit "npu0_vlink0"

        set vdom "root"

        set vrf 10

        set ip 172.16.201.1 255.255.255.0

        set allowaccess ping https ssh snmp http

    next

    edit "npu0_vlink1"

        set vdom "root"

        set vrf 20

        set ip 172.16.201.2 255.255.255.0

        set allowaccess ping https ssh snmp http telnet

    next

end

In the end you would have a static route in each VRF that points to a vdom link that is tied into VRF 0 and then the necessary policies to allow the traffic from the vdom link out the WAN connection you have.

Hope this helps.