Support specific VRF ID for local-out traffic

A Virtual Routing and Forwarding (VRF) instance can be specified for local-out traffic to provide traffic segregation, optimized routing, and enhanced policy enforcement.

The following configuration commands include the option to set a VRF instance number:

config system interface
    edit "port2"
        set dhcp-relay-vrf-select 
    next
end

dhcp-relay-vrf-select <integer>

VRF ID used for connection to sever. Set VRF instance number (0 to 511, default = 0).

config system settings
  set dhcp-proxy-vrf-select <integer>
end

dhcp-proxy-vrf-select <integer>

VRF ID used for connection to sever. Set VRF instance number (0 to 511, default = 0).

config system dns
    set vrf-select <integer>
end

config system fortiguard
    set vrf-select <integer>
end

config system snmp community
  edit <id>
    config hosts
        edit <id>
          set vrf-select <integer>
        next
    config hosts6
        edit <id>
            set vrf-select <integer>
        next
    next
end

config system snmp user
    edit <name>
        set vrf-select <integer>
    next
end

config system email-server
    set vrf-select <integer>
end

config system vdom-dns
    set vrf-select <integer>
end

config system external-resource
    set vrf-select <integer>
end

config system fortindr
    set vrf-select <integer>
end

config system central-management
    set vrf-select <integer>
end

config system netflow|vdom-netflow
    config collectors
        edit <id>
            set vrf-select 
        next
    next
end

config system ntp
    config ntpserver
        edit <id>
            set vrf-select <integer>
        next
    next
end

config system fortisandbox
    set vrf-select <integer>
end

config log syslogd setting
    set vrf-select <integer>
end

config log fortiguard setting
    set vrf-select <integer>
end

config log disk setting
    set vrf-select <integer>
end

config log tacacs+accounting setting
    set vrf-select <integer>
end

config log fortianalyzer|fortianalyzer2|fortianalyzer3|fortianalyzer-cloud setting
    set vrf-select <integer>
end

config system dns-database
    edit <name>
        set vrf-select <integer>
    end
end

config user external-identity-provider
    edit <name>
        set vrf-select <integer>
    end
end

config user fsso
    edit <name>
        set vrf-select <integer>
    end
end

config user ldap
    edit <name>
        set vrf-select <integer>
    end
end

config user radius
    edit <name>
        set vrf-select <integer>
        config accounting-server
            edit <id>
                set vrf-select <integer>
            end
        end
    end
end

config user tacacs+
    edit <name>
        set vrf-select <integer>
    end
end

config vpn certificate setting
    set vrf-select <integer>
end

config vpn kmip-server
    edit <name>
        set vrf-select <integer>
    end
end

vrf-select <integer>

VRF ID used for connection to sever. Set VRF instance number (0 to 511, default = 0).

The following execute commands now include the option to specify a VRF instance number:

# execute ping-options vrf <integer>
# execute ping6-options vrf <integer>
# execute traceroute-options vrf <integer>

vrf <integer>

VRF ID (0 to 511).

The following execute command now includes the option to specify a VRF instance number:

# execute tracert6 -v <integer>

-v <integer>

VRF ID (0 to 511).

The following diagnose commands now include the option to specify a VRF instance number:

# diagnose ip proute match <dst> <src> <iif> <proto> <dport> <sport> <vrf>
# diagnose ipv6 proute match <dst> <src> <iif> <proto> <dport> <sport> <vrf>
# diagnose test authserver radius-direct <server_name or IP> <port number (0 default port)> <udp | tcp | tls> <secret> <pap | chap | mschap | mschap2> <vrf> <user> <password

vrf <integer>

VRF ID (0 to 511).

Example 1: RADIUS server and VRF ID

In this example, the local-out traffic flows through the VRF interface to its destination. The VRF server can be reached by port1 (VRF 22), but not port2 (VRF 0).

To configure a VRF ID for a RADIUS server:

1. Specify a VRF ID for the RADIUS server:

   config user radius
       edit "FAC"
           set server "192.168.100.129"
           set secret ftntxxxxxx
           set password-renewal disable
           set vrf-select 22
       next
   end

2. Get the static routing table:

   # get router info routing-table static
   Routing table for VRF=0
   S*      0.0.0.0/0 [5/0] via 10.100.1.249, npu0_vlink0, [1/0]
   S       192.168.100.0/24 [10/0] via 172.16.205.11, port2, [1/0]
   
   Routing table for VRF=22
   S*      0.0.0.0/0 [2/0] via 172.16.200.254, port1, [1/0]

Example 2: ping command and VRF ID

In this example, the local-out traffic flows through the VRF interface to its destination. IP address 3.3.3.3 can be reached by port1 (VRF 22).

To use a VRF ID with ping:

1. Get the static routing table:

   # get router info routing-table static
   Routing table for VRF=0
   S*      0.0.0.0/0 [5/0] via 10.100.1.249, npu0_vlink0, [1/0]
   S       3.3.3.0/24 [10/0] via 172.16.205.11, port2, [1/0]
   S       192.168.100.0/24 [10/0] via 172.16.205.11, port2, [1/0]
   
   Routing table for VRF=22
   S*      0.0.0.0/0 [2/0] via 172.16.200.254, port1, [1/0]

2. Specify a VRF ID for the interface with ping access allowed:

   config system interface
       edit "loop2"
           set vdom "root"
           set vrf 22
           set ip 1.1.1.2 255.255.255.255
           set allowaccess ping https http
           set type loopback
           set snmp-index 84
       next
   end

3. Execute the ping command:

   # execute ping-options vrf 22
   
   # execute ping-options source 1.1.1.2
   
   # execute ping 3.3.3.3
   PING 3.3.3.3 (3.3.3.3): 56 data bytes
   64 bytes from 3.3.3.3: icmp_seq=0 ttl=255 time=0.1 ms

Example 3: traceroute command and VRF ID

The VRF ID can be used with the traceroute command.

To use a VRF ID with traceroute:

1. Get the routing table details for IP address 3.3.3.3:

   # get router info routing-table details 3.3.3.3
   
   Routing table for VRF=0
   Routing entry for 3.3.3.3/32
     Known via "ospf", distance 110, metric 10200, best
     Last update 05:53:57 ago
     * vrf 0 172.16.203.2, via agg1
   
   
   Routing table for VRF=22
   Routing entry for 3.3.3.3/32
     Known via "ospf", distance 110, metric 11000, best
     Last update 05:31:31 ago
     * vrf 22 172.16.200.4, via port1
     * vrf 22 172.16.200.40, via port1

2. Execute a traceroute for VRF 22:

   # execute traceroute 3.3.3.3
   VRF 22, traceroute to 3.3.3.3 (3.3.3.3), 32 hops max, 3 probe packets per hop, 84 byte packets
    1  3.3.3.3  0.135 ms  0.090 ms  0.073 ms

Example 4: diagnose command and VRF ID

Like the other examples in this topic, port1 is in VRF 22, and port2 is in VRF 0. This example demonstrates how the diagnose ip proute match command works with and without a specified VRF ID.

To use a VRF ID with a diagnose command:

1. Configure the router policy for port1 and port2:

   config router policy
       edit 1
           set dst "23.23.23.23/255.255.255.255"
           set gateway 172.16.200.55
           set output-device "port1"
       next
       edit 2
           set dst "23.23.23.23/255.255.255.255"
           set gateway 172.16.205.11
           set output-device "port2"
       next
   end

2. Run the diagnose firewall proute list command:

   # diagnose firewall proute list
   list route policy info(vf=root):
   
   id=1(0x01) dscp_tag=0xfc 0xfc flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 port=src(0->0):dst(0->0) iif=0(any)
   path(1): oif=7(port1) gwy=172.16.200.55
   source wildcard(1): 0.0.0.0/0.0.0.0
   destination wildcard(1): 23.23.23.23/255.255.255.255
   hit_count=1 rule_last_used=2024-10-11 15:40:23
   
   id=2(0x02) dscp_tag=0xfc 0xfc flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 port=src(0->0):dst(0->0) iif=0(any)
   path(1): oif=8(port2) gwy=172.16.205.11
   source wildcard(1): 0.0.0.0/0.0.0.0
   destination wildcard(1): 23.23.23.23/255.255.255.255
   hit_count=2 rule_last_used=2024-10-11 15:40:39
   

3. Run the diagnose ip route match command without a VRF ID:

   When the VRF is not specified, VRF 0 is used, and it will match port2.

   # diagnose ip proute match 23.23.23.23 2.2.2.22 port4 6 23 23
   dst=23.23.23.23 src=2.2.2.22 smac=00:00:00:00:00:00 iif=10 protocol=6 sport=23 dport=23 vrf=-1
   id=00000002 type=Policy Route
   seq-num=2 oif=8(port2)flags=0x0

4. Run the diagnose ip route match command with a VRF ID:

   When VRF 22 is specified, it will match policy route with port1, which is in VRF 22:

   # diagnose ip proute match 23.23.23.23 2.2.2.22 port4 6 23 23 22
   dst=23.23.23.23 src=2.2.2.22 smac=00:00:00:00:00:00 iif=10 protocol=6 sport=23 dport=23 vrf=22
   id=00000001 type=Policy Route
   seq-num=1 oif=7(port1)flags=0x0