Technical Tip: How to forward traffic from a transparent mode VDOM to a NAT mode VDOM through a Inter-VDOM link

[rbarnes]

Description	This article describes the configuration needed to forward traffic from a transparent mode VDOM to a routed NAT mode VDOM by using an Inter-VDOM link.
Scope	FortiGate.
Solution	In certain circumstances, there is a need to route traffic from devices in a Transparent mode VDOM to devices in a NAT mode VDOM. Take, for example, the following topology: Below are the needed settings to route traffic from the Transparent mode VDOM to a NAT mode VDOM. Configure the VDOM link in the 'global' VDOM.   Navigate to Network -> Interfaces -> Select 'create new VDOM link.' Ensure the 'type' is set to 'ethernet'. Note: An IP will be required on the 'root' side of the inter-vdom link; in this example, 'nattotrans0' is the interface on the 'root' side, while 'nattotrans1' is on the transparent VDOM side. For this example, the 'nattotrans0' interface needs to be on the same subnet as the client device.                                                                               In the transparent mode, VDOM configures the firewall policy.  Navigate to Policy & Objects -> Firewall Policy -> Select create new. Create a firewall policy from 'port6' to 'nattotrans1'. CLI configuration: config firewall policy     edit 1         set name "port6totrans"         set srcintf "port6"         set dstintf "nattotrans1"         set action accept         set srcaddr "all"         set dstaddr "all"         set schedule "always"         set service "ALL"     next end Configure the policy in the NAT mode VDOM. Navigate to Policy & Objects -> Firewall Policy -> Select create new.      Create a firewall policy from 'nattotrans0' to 'port2'. Note: Bi-directional policies aren't necessarily needed if traffic is only expected to originate from one direction. CLI configuration:  config firewall policy     edit 14         set name "port2transp"         set srcintf "nattotrans0"         set dstintf "port2"         set action accept         set srcaddr "all"         set dstaddr "all"         set schedule "always"         set service "ALL"     next end Traffic should now pass from behind the transparent mode VDOM (transpvdom) to the NAT mode VDOM (root).