By Manny Fernandez

May 27, 2020

Separate VRF for Out-of-Band Management in FortiOS

Separate VRF for Out-of-Band Management in FortiOS

I am currently running FortiOS 6.4 on this FortiGate.  The use case is to have an out-of-band interface that points to a separate routing table or in this case, a VRF which stands for Virtual Routing and Forwarding.  In my scenario I will create one interface port22 as the out-of-band interface.   I configured a fake IP address and routed to a fake network just for this article.

2020-05-23_19-47-27

Here you can see the standard interface configuration.  The only difference is the addition of the set vrf 1 statement.

Note: The default VRF is 0.

Essentially anything routed across via this interface, will be part of VRF1.

2020-05-23_19-48-18

Here we can see entry 5 where I am creating a static route to 10.200.200.0/24 with a gateway of 1.1.1.2 and the device is port22 (This route is now part of VRF1).

When we look at the routing table, we can see the two routes.

2020-05-23_19-46-34

by issuing the get route info routing-table all you can see that there is a route to 10.200.200.0/24 via 1.1.1.2 under the VRF=1 section.

Note: See the default routing table which is VRF=0.

Hope this helps.

VRF Explained: Virtual Routing and Forwarding on FortiGate, Cisco and Juniper

VRF Explained: Virtual Routing and Forwarding on FortiGate, Cisco and Juniper

Learn virtual routing and forwarding (VRF), then build VRFs and route leaking on FortiGate, Cisco IOS XE and Juniper Junos with tested CLI.

Read More
FortiGate IPAM vs DHCP: Differences, Overlap, and What to Check Before You Turn IPAM On

FortiGate IPAM vs DHCP: Differences, Overlap, and What to Check Before You Turn IPAM On

FortiGate IPAM vs DHCP explained: what each one assigns, where they overlap, and what to check before enabling IPAM so it does not renumber...

Read More
Outlook CVE-2026-124194: Patch the Zero-Day That Leaks NTLM Hashes

Outlook CVE-2026-124194: Patch the Zero-Day That Leaks NTLM Hashes

Outlook CVE-2026-124194 leaks NTLMv2 hashes from one opened .msg file. Check fixed builds, force the Office update, and block SMB egress on FortiGate.

Read More