Technical Tip: How to forward traffic from a transparent mode VDOM to a NAT mode VDOM through a Inter-VDOM link

In certain circumstances, there is a need to route traffic from devices in a Transparent mode VDOM to devices in a NAT mode VDOM.

Take, for example, the following topology:

Below are the needed settings to route traffic from the Transparent mode VDOM to a NAT mode VDOM.

1. Configure the VDOM link in the 'global' VDOM.  
   1. Navigate to Network -> Interfaces -> Select 'create new VDOM link.'
   2. Ensure the 'type' is set to 'ethernet'.
   3. Note: An IP will be required on the 'root' side of the inter-vdom link; in this example, 'nattotrans0' is the interface on the 'root' side, while 'nattotrans1' is on the transparent VDOM side.
   4. For this example, the 'nattotrans0' interface needs to be on the same subnet as the client device.
                                                                                   

2. In the transparent mode, VDOM configures the firewall policy. 

   1. Navigate to Policy & Objects -> Firewall Policy -> Select create new.

       

   2. Create a firewall policy from 'port6' to 'nattotrans1'.

       

CLI configuration:

config firewall policy
    edit 1
        set name "port6totrans"
        set srcintf "port6"
        set dstintf "nattotrans1"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
    next
end

3. Configure the policy in the NAT mode VDOM.

   1. Navigate to Policy & Objects -> Firewall Policy -> Select create new.     

   2. Create a firewall policy from 'nattotrans0' to 'port2'.
      Note: Bi-directional policies aren't necessarily needed if traffic is only expected to originate from one direction.

CLI configuration: 

config firewall policy
    edit 14
        set name "port2transp"
        set srcintf "nattotrans0"
        set dstintf "port2"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
    next
end

Traffic should now pass from behind the transparent mode VDOM (transpvdom) to the NAT mode VDOM (root).