Creating a L2 connection between two VDOMs on the same firewall

Hi takarI2,

Yes, this architecture is supported. For communication between two VDOMs on the same FortiGate, the usual approach is to use an inter-VDOM link.

In your case, the basic topology would be:

Prod VDOM ↔ Inter-VDOM Link ↔ Enterprise VDOM

The VDOM link provides the internal connection between the two VDOMs without requiring an additional physical interface. Fortinet documents this as inter-VDOM routing.

For IP connectivity between the storage networks, the general design would be:

1. Create the VDOM link from the Global VDOM and assign one interface to each VDOM.
2. Assign a point-to-point subnet/addressing scheme to the two sides of the link.
3. Add routes in each VDOM for the remote storage subnet(s), using the inter-VDOM link.
4. Create the appropriate firewall policies in both VDOMs to permit only the required traffic between the Prod and Enterprise networks.
5. Avoid NAT for this internal VDOM-to-VDOM traffic unless address translation is specifically required by the design.

the inter-VDOM LAN-to-LAN example follows this same approach: VDOM link, routing on both VDOMs, and firewall policies on both sides.

One terminology point: a standard VDOM link provides Layer-3 connectivity/routing between the VDOMs. If by “L2 connection” you specifically mean extending the same Layer-2 broadcast domain between the two VDOMs, that is a different requirement and should be considered separately.

For the architecture you described, however, if the requirement is simply for the storage networks in Prod and Enterprise to communicate over IP, an inter-VDOM link with routing and explicit firewall policies would be the appropriate starting point.

Hope this helps!

I don’t think two separate VDOMs can share the same VLAN where those storage devices are living in. A VLAN on an FGT is always built on an interface (or port), which becomes a sub-interface. And if one sub-interface (VLAN) is defined in a VDOM, that can not belong to any other VDOMs.
You probably have to route (IP level) traffic out of the unit from both VDOMs and use a (L3) switch to handle the VLAN if it has to be on a VLA, or just create the VLANs with the same vlan-id on two separate physical interfaces that belong to either VDOM, then connected them togather at the ouside L2-switch.

Toshi