| Description | This article describes how to advertise multi-VRF routes using route leaking over an ADVPN tunnel. |
| Scope | FortiGate. |
| Solution |
Topology:
Refer to this document for configuring ADVPN tunnels, ADVPN and shortcut paths.
In the given topology, if route leaking is required between interfaces assigned to VRF 0 and VRF 10, use the configuration provided below.
Port 4 is assigned under VRF 10:
To leak the learned routes to each VRF, an inter-VDOM link is required. This example demonstrates the use of the single-vdom-npuvlink` option within the 'config system global' command to activate NPU inter-VDOM links:
config system interface. edit "VLINK0" end Create a policy to communicate vrf10 network to VRF 0 using a VDOM link, and also create a policy in the reverse direction. config firewall policy end
edit 14 end
BGP configuration. Create a prefix list to advertise and restrict the respective subnets.
config router prefix-list end
The route map can be used to group one or more prefix lists.
config router route-map
Configure VRF leak in BGP, specifying a source VRF, destination VRF, and the route map:
config vrf
Verify the routing table on the spoke FortiGate.
Note: As per the current design, the route leak will only work if the route map for return traffic is also applied to the BGP configuration.
Related documents: Route leaking between VRFs with BGP |
