Enabling VDOM downsides

[amorales]

Hi, I am wandering if there is any downside due to enabling VDOMs in a FortiGate. As far I know, by default all VDOMs could make use of all firewall resources and there is no any limitation except if the admin configure them explicitly, but I just want to confirm if there is some limitations or constraints for enabling VDOMs compared to do not using them. I want to enable VDOMs to use the root VDOM just for management traffic, and create only one extra VDOM for production traffic. Thanks.

[emnoc]

Downsides? You mention it in resources limits. And you need to carefully think out what interface/port you assign to a vdom since it can only be in one.

Now in your request this is done a lot where management is done via one vdom and production in the other. You should also think heavily on how the 2 will talk to internet( do you use emac-vlan, or a dedicated wan-port, or vdom-links, etc...)

And lastly SDWAN is that something you need now or might need later ?

Ken Felix

[amorales]

Thank you Ken. Yes, I am aware of VDOM configuration and I am keeping in mind how to talk to Internet from the root VDOM.

On the other hand, if I have FortiManager, will the root VDOM also consume an extra license? Thanks.

[emnoc]

What do you mean extra license? All fortigates comes with up to 10vdom ( disregard the smaller units ) . Some are upgradeable to more vdom. Most none sml-to-medium enterprise models are fixed at 10vdoms. Until you. get into models 1000 or larger, vdoms are limited to 10, larger units have upgrade options.

note: Fortimanager can managed a fgt with 1 ,2 , 3 or 10 vdom, nothing changes from it's perspective as a manager.

FYI; Also Fortimanger has it "adom" limits also and device total managed # of devices but these are primary on the bigger managers.IIRC you can't update adom totals but total number of devices is a license option. Thank of adon as administration domains so you can partition a fmgr to allow admo-1 to managed only fgt#1,#2,#3, and adom2 can only managed fgts,#4,#5,#6

Ken Felix 

[lobstercreed]

Ken,

I'm afraid you may be mistaken when you say nothing changes from the FMG perspective with multiple VDOMs.  I have a single HA pair of FGTs that have 3 VDOMs and consume 3 licenses on FMG.  That's also what our SE told me when he sized our FMG licensing.

So yes, Arnaldo, your concern about licensing is valid.  I'd be happy to be proven wrong.  - Daniel

[Yurisk]

@Ken - what the OP meant was licenses on the FMG side, and as Daniel mentioned already - yes, each additional VDOM on the managed by FMG FGT will use up additional license out of total paid for.

@amorales May be split-vdom - when one VDOM is for management only will not eat up separate license ? Just thinking out loud.

[emnoc]

Okay yes that is correct each vdom is going to consume a license. So you have to determine how many fortigates , how mnay vdoms total and then go with that number and growth.

keep in mind buying add-ons can get to pricey. 

E.g 

  add a 10 add-on   10 times,  would cost 2x more than buying a 100 add-on just one time

I would speak to the sales team if are using or planning fmgr to see what discounts you can leverage but YMMV.

Ken Felix