Usage of vdoms when migrating from Checkpoint virtual instances
Hi,
wanted to check in the community for some feedback on the following.
Currently: Checkpoint VSX environment running four instances : DMZ, Internet, mobile vpn and site-to-site-vpn to Azure. They all have a bunch of vlans, but let's say they have one vlan 100 to communicate to each other. Migrating to Fortigate.
Introducing 2 Fortigate clusters. One for mobile vpn. And one for DMZ, Internet and site-to-site-vpn.
On this last one we're debating around the usage of vdoms or not.
When adding multiple vdoms i see additional complexity, more work to configure and maintain, seperate routing tables on each vdom. And as far as i've found, this means that every vdom needs to use it's own physical interface. (specially since we have a bunch of public ip's on internet and dmz allowing specific services to the inside network). So tripling the number of physical interfaces we need to use ( so we would need 8 physical interfaces when using laggr (2 dmz, 2 internet, 2 vpn, 2 ha) per fortigate in that specific cluster.
There is no multi tenancy here or seperate admin access needed.
Maybe it's just in our head that we need physical separation using vdoms? Which is a classical network setup. The fact that if you have a security breach on a single vdom setup means the complete platform is impacted. And when you have multiple vdoms this is limited?
Not sure if there are other pro's and cons?