VRF Leaking 6.4.5 with more the 2 VRFs

Question

FortiGate 60F FortiOS 6.4.5

I am trying to figure out how to build the npu0_vlink to be able to create VRF-Leaking with up to 5 VRFs. I followed the instructions on https://docs.fortinet.com/document/fortigate/6.4.0/new-features/834664/route-leaking-between-vrfs, but to keeps things simple I am using static routes to add the routes, which works fine. With 2 VRF. But now I need to allow VRF 30 to also access VRF 10, and VRF 3 to access VRF 5. I create new npu0_vlink2 and so one, but they don't seem to work if I do a diag sys session list, it looks like it has a problem getting a mac for the remote side of the npu link.

This works!

edit "npu0_vlink0"
        set vdom "root"
        set vrf 10
        set ip 172.16.201.1 255.255.255.0
        set allowaccess ping https ssh snmp http
    next
    edit "npu0_vlink1"
        set vdom "root"
        set vrf 20
        set ip 172.16.201.2 255.255.255.0
        set allowaccess ping https ssh snmp http telnet
    next
end

The below does not work!

edit "npu0_vlink3" set vdom "root" set vrf 3 set ip 172.16.201.3 255.255.255.0 set allowaccess ping https ssh snmp http set device-identification enable set role lan set snmp-index 28 set interface "internal5" set vlanid 3 next edit "npu0_vlink4" set vdom "root" set vrf 4 set ip 172.16.201.4 255.255.255.0 set allowaccess ping https ssh snmp http set device-identification enable set role lan set snmp-index 29 set interface "internal4" set vlanid 4 next end

Toshi_Esumi · Answer

npuX_vlinks are physical interfaces based on your model's npu chip(s). You can't create or remove them.

Each npu vlink has only two interfaces 0 and 1, like npu0_vlink0 and npu0_vlink1. Nothing more. Then you can use 0 on one end and 1 to the other as in the example.

If you need to have more than one pair on one npu-vlink, you have to use VLAN subinterfaces on the vlink. The most common cases are bridging between VDOMs, like connecting root vdom to all other vdoms, which could be many. In that case one VLAN interface on npu0_vlink0 is on root vdom side, another VLAN interface with the same VLAN ID on npu0_vlank1 is on the other vdom side. Then they can communicate each other over the VLAN after you put proper routing&policy in place.

Sign up

Login with SSO

Login to the community

Login with SSO