Skip to main content
B
bahaa33
New Member
July 4, 2026
Question

help with vdom

  • July 4, 2026
  • 2 replies
  • 24 views

I have already completed the configuration of my FortiGate firewall. However, I now need to enable and configure VDOMs and divide the firewall into multiple VDOMs.

Will enabling and configuring VDOMs at this stage affect my existing firewall configuration, policies, interfaces, routes, or other settings? Or can this be done safely without impacting the current configuration?

Are there any important considerations, best practices, or precautions that I should be aware of before enabling and configuring VDOMs?

Thank you.

2 replies

AEK
SuperUser
AEK
SuperUser
July 6, 2026

Here it is:

 

AEK
    sjoshi
    Staff
    sjoshi
    Staff
    July 7, 2026

    Hi ​@bahaa33 

     

    Impact on Existing Configuration
    Enabling VDOM mode on a FortiGate that already has a complete configuration can be done safely, with the following specific impacts documented:

     

    What is Preserved Automatically
    Configuration Migration: When VDOM mode is enabled, the existing configuration is automatically migrated into the root VDOM by FortiOS. System-level settings such as DNS, NTP, FortiGuard, and SNMP are moved to the global context.
    Firewall Policies and NAT: Firewall policies, NAT configurations including VIPs and policy NAT settings, remain intact after migration into the root VDOM and continue to operate without requiring redesign or recreation.
    Traffic Sessions: Existing traffic sessions continue to pass through the FortiGate without interruption. Only administrative sessions are disconnected and will require re-login after the mode switch 
    Interfaces: All physical, VLAN, loopback, and aggregate interfaces are automatically assigned to the root VDOM with existing configuration preserve
    Routing: Static routes and routing configurations are preserved within the root VDOM and continue functioning normally. Protocols such as BGP and OSPF continue operating as configured within the root VDOM 
    VPN Configurations: IPsec and SSL VPN configurations are migrated to the root VDOM and remain operational after migration.

     

    What Changes
    Administrator Accounts: Administrator accounts become global admins. VDOM-specific admin roles will require manual configuration if needed


    Enabling VDOM Mode
    config system global  
    set vdom-mode multi-vdom  
    end  

     

    Refer:
    https://community.fortinet.com/fortigate-3/technical-tip-enable-and-disable-vdom-admin-98181
    https://community.fortinet.com/fortigate-3/technical-tip-fortigate-enabling-and-managing-vdom-mode-228312

    Thanks, Salon
    Terms & ConditionsAccessibility statement