Create a VDOM with multiple LAN "inside" but using same RFC 1918 address
hi,
i'm planning to build a new FGT VDOM with a single WAN then with multiple "inside" VLAN interfaces, i.e. corporate and guest VLAN.
the customer will use all the RFC 1918 address space, so i'll prepare static route and SNAT for the 10.xx, 172.xx and 192.xx subnet.
my question is, is the VDOM setup "feasible"? i have same RFC 1918 static routes to both "inside" for corp and guest sub-interface/VLAN which have different exit interface and gateway and RFC 1918 for SNAT/PAT to the single WAN public interface/IP?
config router static
!! Corp VLAN
edit 1
set status enable
set gateway 172.16.45.20
set dst 10.0.0.0 255.0.0.0
set device "po1.10"
next
edit 2
set status enable
set gateway 172.16.45.20
set dst 172.16.0.0 255.240.0.0
set device "po1.10"
next
edit 3
set status enable
set gateway 172.16.45.20
set dst 192.168.0.0 255.255.0.0
set device "po1.10"
next
!! Guest VLAN
edit 4
set status enable
set gateway 172.16.17.25
set dst 10.0.0.0 255.0.0.0
set device "po1.20"
next
edit 5
set status enable
set gateway 172.16.17.25
set dst 172.16.0.0 255.240.0.0
set device "po1.20"
next
edit 6
set status enable
set gateway 172.16.17.25
set dst 192.168.0.0 255.255.0.0
set device "po1.20"
end
end
config firewall addrgrp
edit "corp-subnet-group"
set member "10.0.0.0_8" "172.16.0.0_12" "192.168.0.0_16"
next
edit "guest-subnet-group"
set member "10.0.0.0_8" "172.16.0.0_12" "192.168.0.0_16"
end
end
config firewall security-policy
edit Corp Internet Outbound
set srcintf "po1.10"
set dstintf "npu0_vlink1.5"
set srcaddr "corp-subnet-group"
set dstaddr "any"
set service "ALL"
set schedule "always"
set status enable
set action accept
set nat enable
next
edit Guest Internet Outbound
set srcintf "po1.20"
set dstintf "npu0_vlink1.5"
set srcaddr "guest-subnet-group"
set dstaddr "any"
set service "ALL"
set schedule "always"
set status enable
set action accept
set nat enable
end
end
