Description
This article describes the basic difference between NPU vdom link, NPU vdom link with VLAN ID and Vdom link.
Scope
FortiGate.
Solution
- NPU Vdom Link.
NPU vdom links are in build and the moment you enable multi vdom mode the 'npu0_vlink' interface name visible in FortiGate under interfaces.
Let say if a hardware has npu4 or np6lite the then interface name shows like 'npu0_vlink0' and 'npu0_vlink1' in interface list.
It is possible to use this vdom link to communicate between two VDOM´s.
It has always good to have ingress and egress interface in same NPU for better performance in case fortigate hardware have multiple NPU (NP6&np4).
next
edit "npu0_vlink0"
set vdom "root"
set type physical
set snmp-index 22
next
edit "npu0_vlink1"
set vdom "root"
set type physical
set snmp-index 23
- NPU Vdom Link with VLAN.
NPU vdom link with VLAN tag like a sub-interface and can be used when it is necessary to connect multiple VDOM.
For the links to work, the VLAN interfaces must be added to the same NPU VDOM link interface, must be on the same subnet, and must have the same VLAN ID.
Topology to understand.
Interface with VLAN 100 in root VDOM.
edit "VLAN-100"
set vdom "root" <------------------
set ip 100.0.0.1 255.255.255.252
set allowaccess ping https ssh snmp http fgfm
set alias "npu0_vlink0_100"
set device-identification enable
set role lan
set snmp-index 30
set interface "npu0_vlink0" <-----
set vlanid 100
edit "Vdom-1_VLAN-100"
set vdom "Vdom-1"<-----
set ip 100.0.0.2 255.255.255.252
set allowaccess ping https ssh snmp http
set alias "npu0_vlink1_100"
set device-identification enable
set role lan
set snmp-index 31
set interface "npu0_vlink1" <-----
set vlanid 100
Same way can create another VLAN interface for example VLAN 300 between root Vdom and vdom-3.
- Interface with VLAN 300 in root & vdom-3 VDOM.
In Root Vdom.
In Vdom-2.
Similar way can create NPU Vdom link between to non-root Vdom also as example npu Vdom vlan link (vlan 105) between vdom-2 and Vdom-4
In Vdom-2.
In Vdom-4.
- VDOM Link.
It is possible to create Vdom link as many as wanted, in order to communicate between any two VDOM in FortiGate.
Vdom links are similar to Vlan sub-interface, a virtual interface between two VDOMs and it enable the inter-vdom routing between those two vdom.
Vdom link will not support NPU acceleration and & offload.
Below example one vdom link(Non-NPU) created between vdom-2 and vdom-4 as per topology with IP 106.0.0.0/32.
Similar way Vdom link can create between root & vdom-1, vdom-2 etc.
