Create a VDOM with multiple LAN "inside" but using same RFC 1918 address

[johnlloyd13]

hi,

i'm planning to build a new FGT VDOM with a single WAN then with multiple "inside" VLAN interfaces, i.e. corporate and guest VLAN.

the customer will use all the RFC 1918 address space, so i'll prepare static route and SNAT for the 10.xx, 172.xx and 192.xx subnet.

my question is, is the VDOM setup "feasible"? i have same RFC 1918 static routes to both "inside" for corp and guest sub-interface/VLAN which have different exit interface and gateway and RFC 1918 for SNAT/PAT to the single WAN public interface/IP?

config router static

!! Corp VLAN

edit 1
 set status enable
 set gateway 172.16.45.20
 set dst 10.0.0.0 255.0.0.0
 set device "po1.10"
next
edit 2
 set status enable
 set gateway 172.16.45.20
 set dst 172.16.0.0 255.240.0.0
 set device "po1.10"
next
edit 3
 set status enable
 set gateway 172.16.45.20
 set dst 192.168.0.0 255.255.0.0
 set device "po1.10"
next

!! Guest VLAN

edit 4
 set status enable
 set gateway 172.16.17.25
 set dst 10.0.0.0 255.0.0.0
 set device "po1.20"
next
 edit 5
 set status enable
 set gateway 172.16.17.25
 set dst 172.16.0.0 255.240.0.0
 set device "po1.20"
next
edit 6
 set status enable
 set gateway 172.16.17.25
 set dst 192.168.0.0 255.255.0.0
 set device "po1.20"
end
end

config firewall addrgrp

 edit "corp-subnet-group"
 set member "10.0.0.0_8" "172.16.0.0_12" "192.168.0.0_16"
next

 edit "guest-subnet-group"
 set member "10.0.0.0_8" "172.16.0.0_12" "192.168.0.0_16"
end
end

config firewall security-policy
 edit Corp Internet Outbound
 set srcintf "po1.10"
 set dstintf "npu0_vlink1.5"
 set srcaddr "corp-subnet-group"
 set dstaddr "any"
 set service "ALL"
 set schedule "always"
 set status enable
 set action accept
 set nat enable
next

edit Guest Internet Outbound
 set srcintf "po1.20"
 set dstintf "npu0_vlink1.5"
 set srcaddr "guest-subnet-group"
 set dstaddr "any"
 set service "ALL"
 set schedule "always"
 set status enable
 set action accept
 set nat enable
end
end

[funkylicious]

if you require the usage of all RFC1918 spaces for the traffic, meaning you have overlapping subnets, then yes.

A multi-vdom approach would be the wise choice, creating a Guest VDOM, Corp VDOM and root VDOM ( which will have the Internet link and will be the mgmt vdom ).

And because of the overlap of subnets, you would need to NAT the traffic with the IP of the inter-vdom link in the source VDOM and have a default route towards root in each vdom, in order for reply traffic/packets to get back to the correct source that initiated the traffic, as I think you already thought of this.

[johnlloyd13]

no, this is just for a single VDOM with corp and guest VLAN/subnet on it. both using RFC 1918 address space. is this setup feasible?

both corp and guest static have the same routing to RFC 1918 but with different interface/gw hop, then SNAT for the same RFC 1918 subnet/group using the single WAN/egress interface IP.

[funkylicious]

you would have most likely asymmetric routing problems if you use the same VDOM to route the same subnets to different next hops.

even if you disable it, you might still get issues therefore a same bet/approach would be to have different vdoms for each use-case since you have overlapping subnets.

vrf's would help but you would need to configure inter-vrf routing/leak in order to have it work properly.

[johnlloyd13]

hi,

we do have VRF separation in the downstream PE router for the corp and guest VLAN. would this be still considered a potential for asymmetric routing?

why can't a VDOM have multiple sub-interface/VLAN but downstream user/subnet are the same RFC1918? is the a HW or VDOM design limitation?