VRF FortiGate behavior
Could anybody confirm if below is the normal way FortiGate handles VRF logic?
I have a Router connected to port1 on my Fortigate, port1 belongs to VRF1 on the FG.
Port2 on the FortiGate belongs to VRF2.
RTR-------PORT1 FG VRF1----\\\\\\\\\----VRF2 FG PORT2--------------PC
For testing purposes I created a static route destined to FG Port2 subnet on my router, next hop FG port1.
Then I ping from the router to FG Port2 IP and...I was expecting for that NOT to work since in my mind the Fortigate will not pass traffic that it receives on Port1 (VRF1) to Port2(VRF2)
Long story short, it did work, ping was successful. I also tried to ping from FG port1 to port2 and it also worked. I then connected a PC to port2 and that one, I wasn't able to ping from the router.
I don't think that's the way VRF works in other Layer3 devices, I'm not expecting the FortiGate to behave exactly as a Router, just wanted to confirm if that's the expected behavior or if I am missing something.
My conclusion is that "regular VRF" logic doesn't apply to FortiGate interfaces themselves. Am I wrong or Am I right?