OSPF Redistribution Issue with Multiple VRFs

[Judbe]

Hello!
I have multiple VRFs configured on a Fortigate device and I can see that OSPF creates a separate process per VRF:

OSPF Router with ID (10.10.10.10) (Process ID 1, VRF 1)
OSPF Router with ID (10.10.10.10) (Process ID 2, VRF 2)
OSPF Router with ID (10.10.10.10) (Process ID 3, VRF 3)
...

Each VRF should be isolated but when enabling "Redistribute Connected", OSPF starts advertising all directly connected networks across all VRFs, causing routing loops.

I have tried using route-maps to filter the redistribution, but the issue persists. It seems that Fortigate treats redistribution as global per VDOM rather than per OSPF process/VRF.

Questions:
* Is there a way to ensure that "Redistribute Connected" only applies within its respective VRF and does not affect other VRFs?
* If this is expected behavior, what is the recommended best practice for redistributing directly connected networks while maintaining VRF isolation?

Thanks in advance for your help!

[ebilcari]

Currently, FGT has some limitations in configuring separate OSPF instances for each VRF. To achieve fully independent OSPF configurations, you should consider using VDOMs.

[palrami]

Hello, are you able to share your config also if you found solution 

[funkylicious]

one option would be to create a route-map that matches the prefix and vrf and use it under redistribute.

[palrami]

Thank you, i have the following configurations but ospf didnt come, basically _leak0 and _leak1 belongs to different vrfs, i saw error about duplicate router id, i was wondering if you can share your ospf configurations

HUB1 (ospf) # show
config router ospf
config area
edit 0.0.0.0
next
end
config ospf-interface
edit "cevrf"
set interface "vrf10_leak1"
set dead-interval 40
set hello-interval 10
set network-type point-to-point
next
edit "pevrf"
set interface "vrf10_leak0"
set dead-interval 40
set hello-interval 10
set network-type point-to-point
next
end
config network
edit 1
set prefix 10.200.255.20 255.255.255.254
next

[funkylicious]

i dont have a working config, i just shared an idea i had about the redistribution.

as for the ospf with intfs in diff vrfs, it should work - https://community.fortinet.com/t5/FortiGate/Technical-Note-OSPF-Support-for-multiple-virtual-routing... 

is the router-id duplicate on FGT on the remote devices ?

[hamanka6]

Maybe I'm missing something from the way you've described your scenario, but why would you have to modify the ASR config? Your OSPF process numbers don't have to match between peers, is that where you were seeing an issue? You should be able to configure the 4500 with OSPF-1 in VRF-A and OSPF-2 in VRF-B, and have both of those OSPF processes peer with OSPF-3 on the ASR.

[Judbe]

Hi!

As @ebilcari wrote: “FGT has some limitations in configuring separate OSPF instances for each VRF. To achieve fully independent OSPF configurations, you should consider using VDOMs.”

And that’s true. Between VDOMs work without any issue, but not within the same VDOM.

What worked for us was to advertise the networks of each VRF in a different OSPF area (within the same VDOM). Everything else we tested eventually caused loops.

Example:

VRF 1 — networks: 10.10.10.0/24, 100.100.100.0/24 — area 1

VRF 2 — network: 20.20.20.0/24 — area 2
...

[ElwinBERRAR]

Yeah, that’s a known limitation on FortiGate. When you enable “redistribute connected” inside a VDOM, it’s applied globally, not per VRF. That’s why connected routes from other VRFs get advertised and cause loops.

The cleanest way to keep things separate is to use one VDOM per VRF. If that’s not possible, your idea of using different OSPF areas for each VRF is probably the safest workaround.

[Toshi_Esumi]

If you separate those VRFs by individual VDOM, you no longer need VRFs. Because those VDOMs are separate routers. To me, that's the safest.

Toshi