Skip to main content
forrest_byrnes
forrest_byrnes
New Member
July 25, 2023
Question

VDOM consolidation on the FortiGate

  • July 25, 2023
  • 2 replies
  • 1987 views

Hi there,

 

The existing 2xFortiGate 300E reached the limit of the VDOMs per device (10 out of 10 are already being used). The ongoing project requires creating another set of VDOMs on the firewall. Since it is not possible to purchase another set of VDOMs for the 300 series model, is there any best practice on how to perform the VDOM consolidation (e.g., moving resources and objects from one VDOM to another VDOM in GUI/CLI) and potentially remove the redundant VDOMs?

2 replies

srajeswaran
Staff
srajeswaran
Staff
July 25, 2023

You will need to remove the objects/resources (interfaces mainly) from the VDOM you are going to delete. They need to be moved to global and then from their you can add them to the new or correct VDOM.

forrest_byrnes
forrest_byrnesAuthor
New Member
July 26, 2023

Thanks for the advice! I was wondering what could be the reason for the Ref. number next to the VDOM object under System > VDOM to be greater than the number of objects displayed once I click on that. For example, one of the VDOMs has a Ref. number set to 20, while the number of objects displayed once I click on that number is 5. Does the Reference option calculate all the nested references as well?

srajeswaran
Staff
srajeswaran
Staff
July 26, 2023

Yes, refernce includes the nested reference as well.  You can use "show full | grep <ref>" to find references. Rememmber to run this from global and from the specific VDOM.
eg: "show full | grep port2"  -> to find references for port2


https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-Check-Referenced-Objects/ta-p/194815

terrence278
terrence278
New Member
July 26, 2023

As for VLANs, it's just routing and creating the needed virtual interfaces. When a tagged frame comes, FortiGate strips VLAN tags and puts the traffic into a virtual interface with the matching VLAN tag on the matching physical interface (Then processes it as usual). Same way in reverse, if a traffic is routed out of a VLAN virtual interface, the tag is added on egress.

Terms & ConditionsAccessibility statement