Description
This article describes how to move a specific FortiGate VDOM from its current ADOM to a new ADOM on either FortiAnalyzer or FortiManager to provide the Administrator or Users separate management access to different VDOMs of the FortiGate.
Scope
FortiGate VDOM, FortiAnalyzer, FortiManager.
Solution
- Enable the ADOM feature on FortiAnalyzer, if not enabled. Enabling the ADOM will log out of the device once.
-
Set the ADOM mode to 'Advanced'. In Advanced mode, assigning a VDOM from a single FortiGate device to a different ADOM is possible.
-
Create a new ADOM (or use any existing ADOM) and move the respective VDOM to the new ADOM, which needs to have a separate management access. System Settings-> All ADOMs-> Create New-> Create a new ADOM and select only the VDOM of FortiGate which needs to be moved to this new ADOM. Refer to a sample screenshot below, on which initially it has added an FGT81E device to the FortiAnalyzer and then enabled ADOM in Advanced Mode. Later while creating the new ADOM, the administrator selects VDOM 'test'.
Output of diagnose dvm device list will display the FortiGate and its ADOM assignment information.
-
Now create an admin user with the required privilege and restrict access to that user only for the specific required ADOM on FortiAnalyzer.
-
Perform SQL database rebuild for both the Old and New ADOM. This is required to remove any Analytic logs from the OLD ADOM for that VDOM and also to create an Analytic Database for the respective VDOM on the new ADOM.
- To rebuild SQL for a specific ADOM, execute the below syntax:
execute sql-local rebuild-adom <adom> <----- Input ADOM name to rebuild the SQL database.
- To check the status of the SQL rebuild.
diag sql status rebuild-adom <adom> <----- Input ADOM name to rebuild the SQL database.
Troubleshooting: The following commands can be used on the Fortianalyzer CLI to debug the SQL DB rebuild:
diagnose sql show db-size -> Repeat this command several times to make sure that the SQL DB is increasing in size
diagnose sql status rebuild-db -> Show the SQL DB rebuild progress and the time the Rebuild has been completed successfully
Related article:
Technical Tip: Moving devices and VDOMs between FortiManager ADOMs
https://community.fortinet.com/t5/FortiManager/Technical-Tip-How-to-move-devices-VDOMs-between-Forti...
