Chapter 8. VDOM
8.2 Inter-VDOM Routing
Learning Objectives
- Configure a VDOM to pass traffic between VDOMs
- Configure an Inter-VDOM routing
Scenario: Inter-VDOM routing is the communication between VDOMs. VDOM links are virtual interfaces that connect VDOMs. A VDOM link contains a pair of interfaces, each one connected to a VDOM and forming either end of the inter-VDOM connection. We want to create a link between VDOM Sales and Accounting, then the traffic from WebTerm1 should be reached to WebTerm2.
| Device | IP address | Access |
|---|---|---|
| WebTerm1 | 192.168.1.2/24 | – |
| WebTerm2 | 172.16.1.2/24 | – |
| FortiGate | Port 1: DHCP Client
Port 2: 172.16.1.1/24 Port 3: 192.168.1.1/24 |
Port 1: https, ping |
| Cloud1 | – |
- First, enable VDOMs in the firewall.
FGVM01TM19008000 # config system global
FGVM01TM19008000 (global) # set vdom-mode multi-vdom
FGVM01TM19008000 (global) # end
- Create two VDOMs, Sales and Accounting.
- Configure IP addresses for the Interfaces Port2 and Port3. Assign port3 to Sales Vdom and port2 to Accounting Vdom.
- Go to Global VDOM > Network Interfaces > Create a new VDOM Link, and configure it as Figure 8.25:
- In Accounting VDOM, Create two static routes:
- Destination: 192.168.1.0/255.255.255.0
- Interface: Accounting-Sales
- Gateway: 10.10.10.2
- Destination: 172.16.1.0/255.255.255.0
- Interface: Accounting-Sales
- Gateway: 10.10.10.2
- In Accounting VDOM, Create two Firewall Policies:
- Incoming: Port 2
- Outgoing: AS0
- NAT Disable
Incoming:
- Incoming: AS0
- Outgoing: Port2
- NAT Disable
- In Sales VDOM, Create two static routes:
- Destination: 192.168.1.0/255.255.255.0
- Interface: AS1
- Gateway: 10.10.10.1
- Destination: 172.16.1.0/255.255.255.0
- Interface: AS1
- Gateway: 10.10.10.1
- In Sales VDOM, Create two Firewall Policies:
- Incoming: Port3
- Outgoing: AS1
- NAT Disable
- Incoming: AS1
- Outgoing: Port3
- NAT Disable
- Now, you should verify your configuration and should be able to ping from WebTerm1 to WebTerm2.
To delete a VDOM link in the CLI:
config system vdom-link
delete <VDOM-LINK-Name>
end