FortiGate VDOM

[kpetrov21]

Hello Guys,

First of all I want to say that I am glad to participate in this Forum discussions.

I have a question regarding FortiGate VDOMs use cases

I am working for a client which use FortiGates for firewall solution.

With the current setup they split FortGate into Multiple VDOMs.

Usually they are doing this when site have Two Internet service providers.

root VDOM - Internal Netowork

fw1 VDOM - Primary Internet provider

fw2 VDOM - Secondary Internet provider

Inter-vdom links between root-fw1 and root-fw2

two default routes on the root VDOM (towards fw1 and fw2 VDOMs)one with lower priority towards the preferred LINE.

They are utilizing the secondary provider by configuring static routes on root vdom which are pointing to fw2 VDOM (Some kind of a load-sharing).

In NSE self study guide I've learned that usually you would need to split FortiGate box when you are managed security service provider and you want assign different VDOMs to different customers.

But why and when you would need to do this when the device is totaly dedicated to one customer.

The guys who made this design are no longer working for the company and there is no one who can give me feasible reason why they did it this way.

In my opinion this setup is just adding more complexity because of the InterVDOM routing.

Moreover there is a project for integrating FortiManager and when you have one box with 3 VDOMs FortiManager license counts 3 devices.

I will be very thankful if someone can explain me what can be achieved with this setup which cannot be without VDOMs.

Thanks.

[gradius85 · Accepted solution]

I am just starting to learn about SDN-LAN and SDN-WAN.

However, would two VDOMs provide more flexibility in topology and route table? I currently have to manage 8 IPv4 full /24 blocks and a full /48 IPv6 space and been thinking how I could do this better.

When do you know that you need SDN-WAN? What are use case scenarios that you have faced? I have read the documentation and horse-and-pony shows... however, I cannot translate those items to real-world use cases.

[emnoc]

if vdom1 fw1.fw2 are internet only, you would be blessed with using virt-wan ( aka SDWAN  ) and eliminate those 2 vdoms , but that's a guess and opinion on what was posted.

Ken Felix

[lobstercreed]

I'm not sure why there would be 2 Internet-only VDOMs, but I've been planning to split my single VDOM into two so that I can enable asymmetric routing in the Internet VDOM. 

We are running BGP and have run into a problem where if I receive traffic from my secondary provider the firewall fails RPF check on the traffic even though the response could go out the primary provider's interface in the same zone.  The only way I know around this is without majorly changing my routing (not currently feasible) is to enable asymmetric routing.  Obviously I don't want to do this on my root VDOM.

[emnoc]

SDWAN would still be beneficial in that case. Once you enable asymmetrical routing, stateful checks are pretty much gone or reduced

Ken Felix

[Toshi_Esumi]

I agreed to lobstercreed's point. When I was testing SD-WAN myself I found it's difficult to split two (or multiple) VPNs, members of SD-WAN (FGT can have only one instance of "SD-WAN" instance), to different nodes and do split-tunnel on each interface, causing asym-routing. A solution is to separate the routing domain from the FWing domain by two vdoms. I still need to test it though.

[gradius85 · Accepted solution]

I am just starting to learn about SDN-LAN and SDN-WAN.

However, would two VDOMs provide more flexibility in topology and route table? I currently have to manage 8 IPv4 full /24 blocks and a full /48 IPv6 space and been thinking how I could do this better.

When do you know that you need SDN-WAN? What are use case scenarios that you have faced? I have read the documentation and horse-and-pony shows... however, I cannot translate those items to real-world use cases.

[Toshi_Esumi]

I started writing a long version of my answer but scratched that. Instead, I just second Ken's suggestion if you just need to utilize two internet circuits and not site-to-site VPNs to worry about you can use SD-WAN for redundancy. And I wouldn't split VDOMs, which would complicate routing without any added benefit.

[emnoc]

Adding more vdom adds more route-domains. So this means the routing topology is more complex. Why do you think you need 3 vdoms ( internal and two internet ) ? What can you not do with SDWAN vs multi-vdoms?

[kpetrov21]

I can't see any reason why they are using VDOMs except adding more complexity.

I am thinking about offering redesign to our client.

another common example in the existing setup:

root VDOM - connected to MPLS provider. and another link for user_lan

fw1 VDOM - local breakout ISP

Production VDOM - for some productive networks.

Maybe they tried to make some kind of separation without realizing the consequences.(difficult to support from operations is one example)

Lets say I need to add this device to FortiManager then I would need 3 policy packs for each VDOM.

We have a lot of devices with this setup which means if I add them all to the central management then it will become a mess.

[gradius85]

toshiesumi wrote:

I agreed to lobstercreed's point. When I was testing SD-WAN myself I found it's difficult to split two (or multiple) VPNs, members of SD-WAN (FGT can have only one instance of "SD-WAN" instance), to different nodes and do split-tunnel on each interface, causing asym-routing. A solution is to separate the routing domain from the FWing domain by two vdoms. I still need to test it though.

If you had site-to-site vpns - would you peer them to a different vdom? I was thinking about doing that; however, after design and mapping I didn't think it would buy me anything.