Hi
I am new to Fortigates and currently looking to swap out our Cisco ASA HA Pair with a Fortigate Cluster. I am having a look at how best to design this. Currently we have a /29 point to point with the ISP. Then we also have a /26 public address block used for natting services. currently we only use a single context on the ASA.
I am looking to create 3 VDOMs all of which need internet access. What would be the best ways of achieveing this. Would you recommend the best solution to be to go hierarchical by having a 4th internet facing VDOM (root vdom) terminating the point to point to the ISP. Then for the 3 VDOMs to use the internet VDOM as their gateway. Or is there any other way of achieveing this.
The other thing I am trying to figure is our connection to the DMZ. We will have an interface on each firewall in the cluster connecting to the DMZ host via a switch. The DMZ is segregated into multiple VLANs, and the VLANs need to terminate on the different VDOMs. Can this be achieved so multiple VDOMs share the same physical interface using VLANs.
Thanks
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I don't know if that's widely a common practice to use root vdom as GW to the internet for other vdoms, but at least that's what we do for our FG1Ks/1.5Ks.
FGT's VLANs are similar to Cisco's subinterfaces but can belong one/any VDOM as well as physical interfaces. So yes, you can terminate each VLAN on the DMZ interface at at each individual VDOM.
Regarding DMZ, yes, no problem to allocate different VLANs to different VDOMs over the same physical link, here is reference for that https://kb.fortinet.com/kb/documentLink.do?externalID=FD31639
Regarding multiple VDOMs it heavily depends on the organization and its policy. Usually, in places where different firewalls (in your case VDOMs/contexts) are required for the same company, it is done because of some legal regulation/security policy obligation. Then you have no say in this. In my opinion, if it is the same company and same VDOMs admin(s), then it is more hassle than better security - you have to change multiple policies to do one thing, and finally it ends up the internal VDOMs having rulebase "Permit Any Any" and all work is being down on Root Vdom. Fortigate, after all, works by looking at interface of a policy as well, so allocating each department/unit its own L3 VLAN interface and rule section will do the same work.
When I do advise clients, for easy management purposes, to have multiple VDOMs, is when they have (if migrating) or plan on having large rulebase, then managing this mess of hundreds of rules would be a nightmare.
In other words, like any other firewall, VDOMs in Fortigate is more management separation decision, rather than security based.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.