No seperation using VRFs

[Immu]

Hi,

I have an issue with use of VRFs.
I configured the FGT like descriped in the following instruction: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/752950

The FGT has two IPsec tunnels, one for primary and one as backup.
All traffic has to go through the tunnels, which means there are two default routes with exit interfaces of the VPNs.
If I don't use VRF routing, I have to route each specific IP addresse or range e.g. IP of the peer, LDAP or TACACS+ servers and so on via WAN interfaces...
So I configured a VRF for the customer intranet, which contains tunnel interfaces and LAN.
The other VRF is for the two WAN interfaces primary and secondary.

At the end I have multiple (default) routes:
- two default routes through the tunnels in VRF1 (different AD)
- two default routes through the physical WAN interfaces in default VRF (different AD)
- two blackhole routes for each VRF

config router static
edit 1
set device "VPN-RZ"
set comment "VRF=1"
next
edit 2
set distance 200
set priority 11
set device "VPN-RZ-Backup"
set comment "VRF=1"
next
edit 3
set gateway 100.70.1.1
set device "wan1"
set comment "VRF=0"
next
edit 4
set distance 200
set priority 11
set device "cfg" #cfg is the secondary interface. Don't ask me, why I named it like that :p
set comment "VRF=0"
set dynamic-gateway enable
next
edit 5
set distance 254
set comment "VRF=1"
set blackhole enable
set vrf 1
next
edit 6
set distance 254
set comment "VRF=0"
set blackhole enable
next
end

It seemes to work at the first look... the tunnels get up and all traffic from or for the LAN goes through them.
But I can reach the IP addresses from LAN to WAN via ICMP and reverse.
I would understand, if the traffic would go through multiple hops.
But the FGT routes the traffic locally?!
So there is just one hop, which shouldn't be possible like descriped in the manual above!

So I thought - ok maybe it's a bug and an update of firmware would be helpful. So I did, twice.
And the issue still exists!

The FortiGate shows two routing tables, but the traffic seems not to be seperated.

Here is the interface configuration:
config system interface
edit "wan"
set vdom "root"
set ip <ip address>
set allowaccess ping https ssh snmp http fgfm
set type physical
set lldp-reception enable
set role wan
set snmp-index 1
next
edit "lan1"
set vdom "root"
set type physical
set snmp-index 11
next
edit "lan2"
set vdom "root"
set type physical
set snmp-index 9
next
edit "lan3"
set vdom "root"
set vrf 1
set ip 10.139.240.1 255.255.255.0
set allowaccess ping https ssh snmp http
set type physical
set device-identification enable
set lldp-reception enable
set lldp-transmission enable
set role lan
set snmp-index 8
next
edit "a"
set vdom "root"
set mode dhcp
set allowaccess ping https ssh snmp http
set type physical
set alias "MF-Backup"
set lldp-reception enable
set role wan
set snmp-index 2
next
edit "lan"
set vdom "root"
set vrf 1
set ip 10.139.239.1 255.255.255.0
set allowaccess ping https ssh http fgfm fabric
set type hard-switch
set alias "LAN"
set stp enable
set device-identification enable
set lldp-reception enable
set lldp-transmission enable
set role lan
set snmp-index 5
next
edit "cfg"
set vdom "root"
set mode pppoe
set allowaccess ping https ssh http
set snmp-index 7
set username <username>
set password <password>
set interface "a"
set vlanid 7
next
edit "VPN-RZ"
set vdom "root"
set vrf 1
set type tunnel
set snmp-index 6
set interface "wan"
next
edit "VPN-RZ-Backup"
set vdom "root"
set vrf 1
set type tunnel
set snmp-index 10
set interface "cfg"
next
end

[AEK]

Hi Toshi

I understand it is a local-in traffic, but here is my test scenario (FortiOS 6.2.17):

My laptop is connected to FGT-port1, and I enabled admin access on FGT-port2, without adding any firewall rule and without any local-in policy.

When I try admin-access from my laptop to FGT-port2-IP it is denied.

Then after adding the below firewall rule to allow ssh/https traffic the admin access worked.

• srcintf: port1
• dstintf: port2
• src: my-IP
• dst: port2-IP

It has always worked this way for me and I find it just logical.