Skip to main content
Larry_Dunn
New Member
March 29, 2017
Question

VDOM Basics

  • March 29, 2017
  • 4 replies
  • 9090 views

Apologies if this question seems too simple but I'm confused by the exact nature of a FortiGate VDOM.

1) On a Fortigate (in this case a FG1000D) if you create two separate VDOMS must you assign a separate physical Fortigate port (or ports) - plus separate cables to other network devices - to each VDOM?

or

Can you just, in it's simplest case with 2 separate VDOMs - have one physical port (for example, either one of the two 10GB SFP+ ports or an RJ45 1GB Ethernet port) plugged into the physical FG1000D and then virtually assign different interfaces to each VDOM?

 

(I guess what I'm asking is from the physical FG100D do you have to associate at least one physical port and cable to each VDOM?)

 

2) My second question is - what's the relationship, if any, between a 'VRF' and a FortiGate VDOM?   

 

 

 

    4 replies

    aagrafi
    New Member
    March 30, 2017

    1) Not necessarily. You may assign physical or logical interfaces (like VLANs) to VDOMs. For example, you can do the following configuration:

    edit "port5"   set vdom "root"   set type physical next edit "VLAN-1"   set vdom "root"   set ip ...   set interface "port5"   set vlanid 100 next edit "VLAN-2"   set vdom "other"   set ip ...   set interface "port5"   set vlanid 200 next

     

    2) Different concepts, but you achieve the same functionality (almost), e.g having multiple routing instances in the same box. A key difference is that VRF (or VRF lite) is a standards based protocol, whilst VDOM is strictly Fortinet and stays inside the box.

     

    Hope that helps.

    Larry_Dunn
    New Member
    March 30, 2017

    Many thanks aagrafi for your reply.

    Just clarification on point 1 -

    a) I assume that you can assign more than one 'vlanid' to each VDOM?

    b) Is there a limitation on the number of 'vlanids' which can be assigned to each VDOM?

     

    Again, many thanks for your assistance as I'm getting to grips with networking concepts :=]

    aagrafi
    New Member
    March 30, 2017

    a) Yes, you can have multiple VLANs in the same VDOM.

    b) There are VLAN limitations, but not per VDOM. These are: the maximum number of VLANs is 4094 as per 802.1Q protocol. Also the FG 30D and 30E series has a limitation of 20 VLAN per interface. You may refer to the max value document for more info http://help.fortinet.com/fgt/54/max-values/5-4-0/max-values.html.

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!