Technical Tip: FortiGate: Enabling and Managing VDOM Mode

Description 

This article describes the expected behavior and impact of enabling Virtual Domain (VDOM) mode on a FortiGate device. It covers configuration migration, traffic session continuity, management access, interface behavior, routing, VPN, licensing, and operational considerations.

Scope

FortiGate, FortiOS. All hardware and VM models that support multi-VDOM mode.

Solution

Configuration Migration:

The existing configuration is automatically migrated into the root VDOM by FortiOS. System-level settings such as DNS, NTP, FortiGuard, and SNMP will be moved to the global. Administrator accounts become global admins, so VDOM-specific admin roles will require manual configuration if required. Most configurations are migrated automatically, and manual adjustment may be required for VDOM-specific administrator roles, depending on access requirements. Always take a full config backup before enabling VDOM.

Firewall Policies, NAT, and Traffic Sessions:

Firewall policies are migrated into the root VDOM and continue to operate without requiring redesign or recreation. NAT configurations, including VIPs and policy NAT settings, remain intact after migration into the root VDOM. Existing traffic sessions continue to pass through the FortiGate without interruption. Only administrative sessions are disconnected and will require re-login after the mode switch.

Management Access and Trusted Hosts:

Interface management settings, such as HTTPS and SSH access, are preserved. Access continues through interfaces assigned to the root VDOM. Trusted host configurations remain unchanged after enabling VDOM mode.

SNMP Configuration:

SNMP configuration is moved to the global context. SNMP access is handled through the management VDOM, typically the root VDOM. Starting from FortiOS 7.6, SNMP queries to interfaces in non-management VDOMs are supported.

• Technical Tip: Configuring SNMP when VDOM is enabled

• Technical Tip: How to perform queries using SNMPv3 to non-management VDOMs

Interfaces and LAG Behavior:

All physical, VLAN, loopback, and aggregate interfaces are automatically assigned to the root VDOM with existing configuration preserved. A physical LAG interface can belong to only one VDOM. VLAN interfaces created on top of the LAG can be assigned to different VDOMs. Zone names are VDOM-specific and can be reused independently across different VDOMs.

Technical Tip: How to share a physical interface between VDOMs

Routing and Inter-VDOM Communication:

Static routes and routing configurations are preserved within the root VDOM and continue functioning normally. Protocols such as BGP and OSPF continue operating as configured within the root VDOM. Each VDOM maintains an independent routing table and inter-VDOM communication requires explicit configuration.

VPN Configurations:

IPsec and SSL VPN configurations are migrated to the root VDOM and remain operational after migration.

VDOM Licensing:

VDOM licenses are device-specific and non-transferable. They cannot be moved between FortiGates. However, this license can be transferred while performing RMA. When the licensed VDOM limit is reached, additional VDOM creation is not allowed unless an existing VDOM is removed or license capacity is increased. The Global VDOM does not consume licensed capacity because it does not process traffic. Only the root VDOM and additional user-created VDOMs are counted.

• RMA Note: Contract and Service Auto Transfer Option

• Technical Tip: Purpose of Management VDOM in the case of license/contract information

• Technical Tip: How to tune Maximum Numbers per-VDOM

High Availability Considerations:

HA should be configured first to ensure system-level settings and VDOM structure are synchronized across both cluster members.

Management VDOM:

The management VDOM can be changed from the default root VDOM. However, on FortiGate 6000F, 7000E, and 7000F series, the default management VDOM is mgmt-vdom, and it cannot be changed.

Technical Tip: Impact of changing Management VDOM

Logging and FortiAnalyzer:

Logging can be configured per VDOM or globally. Each VDOM can independently send logs to FortiAnalyzer.

Additional Considerations:

VDOM mode can be disabled only if the configuration is consolidated into a single VDOM environment. This may require significant redesign. When a VDOM is renamed, all configuration references to the previous VDOM name must be updated, including interfaces, policies, and routing objects.

Technical Tip: How to rename a VDOM

Pre-Enablement Validation:

Configuration backup, interface mapping, routing design, administrative access, and service dependencies, including SNMP, should be validated before enabling VDOM mode to ensure operational continuity.