Advanced VDom

[Carl_Wallmark]

Hi, My goal is to setup an enviroment as described in the picture i painted =) Each customer will have their own VDOM, but i still want to control bandwidth and ports etc... Are there anyone, who experienced in this type of setup ? I would like to know if there is any pitfalls i should think of. Each VDOM will have there own public ip, and i will use " IP Pool" for oubound and " Virtual IP" for inbound. Link to picture: http://195.67.73.228/vdom.jpg

[UkWizard]

picture uploading broke a while ago, so it wont work later either until it gets fixed.. suggest you put it on a public drive somewhere.

[Carl_Wallmark]

thanks, i have posted the link now.

[#4]

Looks good to me. I' m doing alot of the same things in both NAT and TP mode.

[Carl_Wallmark]

one of my big concernes is the mapping of a public ip address. i want to set the public ip direct onto the customers vdom instead of 10.10.1.0/28 one solution would be to use TP on the root domain but then the vlink doesn´t work. sooooo, if i could get the ISP (tripnet) to give me the whole subnet including default gateway, i could then route it to the right vdom. Are there any problems using " IP Pool" and NAT' ing a whole public address ?, for example ipsec tunnels etc... ??

[red_adair]

you do not need a Transfer Network for the IntraVDOM Links. Go for this solution: Do NOT put an IP to the " upper" INtraVDOM Links (10.10.1.1/10.10.1.17/10.10.1.33) and put the public IP to the northbound VDOm Interface (that is currently 10.10.1.2 etc.) You can set simple static routes in the root domain to send whatever network in size (/30 /29 etc.) to a certain IntraVDOM Interface. -R.

[Carl_Wallmark]

you mean i should type 0.0.0.0/0 instead of 10.10.1.1 ? but how can i route traffic from WAN1 to the " WAN" link for each VDOM if WAN1 have an IP from the same subnet as the one of the VDOM ? lets say you have: x.x.x.1 x.x.x.2 x.x.x.3 x.x.x.1 is the default gateway on Tripnets router. x.x.x.2 is on WAN1 on fortigate x.x.x.3 is wan link on VDOM1 should i do a static route: x.x.x.3 -> " WAN Link" on VDOM1 in the root domain ?

[Carl_Wallmark]

for those who are intressted, this is a working scenario with Vdoms: http://195.67.73.228/vdom2.jpg

[MBR]

Could you please provide a new link with the working picture?