Fortigate VDOMs instead two CISCO routers

[kzuk]

Hi,

I have used two CISCO routers so far.

The first router provided access to the internet and for the first segment of the network. Behind this router was a second one (behind NAT), which was a network separator. I would like to implement this configuration on one Fortigate 100E. I have already created two VDOMs but I am not sure if I should use VDOM Links or something else.

[ede_pfau]

If you want to go that way VDOM links would be natural to use. The only other setup would be to assign some physical ports to each VDOM and connect them via external cable. Which, in comparison, is not only less elegant but VDOM links might offer more bandwidth on top.

[Toshi_Esumi]

FYI: you can find the configuration in online help.

https://help.fortinet.com...t=inter-vdom%20routing

[oliviahuffman]

nice thank you for sharing!!

[kzuk]

Ok, i have problem. I have configured FortiSwitch with FortiGate. VDOMs configured with VLAN interfaces (FortiSwitch).

I set static routes on both VDOMs and can't send any packets between VDOMs.

Policies configured on both VDOMs and while i try to ping other side i see activity but only on current VDOM.

Communication within VDOM is OK. I have problem with route between VDOMs.

[smari]

what does your debug flow say ?

[kzuk]

Ping from VDOM to another. 

VDOM_Public: one host with IP 172.3.255.10

VDOM_Secure: one host with IP 172.4.255.10

Pinging from 172.4.255.10 to 172.3.255.10. 

Policies set to ALL services.

diagnose debug enable 

diagnose debug flow filter proto 1

diagnose debug flow show function-name enable

diagnose debug flow trace start 20

id=20085 trace_id=4541 func=print_pkt_detail line=5497 msg="vd-VDOM_Secure:0 received a packet(proto=1, 172.4.255.10:1->172.3.255.10:2048) from VLAN_Secure. type=8, code=0, id=1, seq=7894." id=20085 trace_id=4541 func=init_ip_session_common line=5657 msg="allocate a new session-0000cd58" id=20085 trace_id=4541 func=vf_ip_route_input_common line=2591 msg="find a route: flag=04000000 gw-172.3.255.10 via npu0_vlink1" id=20085 trace_id=4541 func=fw_forward_handler line=751 msg="Allowed by Policy-2: SNAT" id=20085 trace_id=4541 func=__ip_session_run_tuple line=3328 msg="SNAT 172.4.255.10->172.4.255.1:60417" id=20085 trace_id=4542 func=print_pkt_detail line=5497 msg="vd-VDOM_Secure:0 received a packet(proto=1, 172.4.255.10:1->172.3.255.10:2048) from VLAN_Secure. type=8, code=0, id=1, seq=7895." id=20085 trace_id=4542 func=resolve_ip_tuple_fast line=5572 msg="Find an existing session, id-0000cd58, original direction" id=20085 trace_id=4542 func=npu_handle_session44 line=1105 msg="Trying to offloading session from VLAN_Secure to npu0_vlink1, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x00000000" id=20085 trace_id=4542 func=__ip_session_run_tuple line=3328 msg="SNAT 172.4.255.10->172.4.255.1:60417" id=20085 trace_id=4543 func=print_pkt_detail line=5497 msg="vd-VDOM_Secure:0 received a packet(proto=1, 172.4.255.10:1->172.3.255.10:2048) from VLAN_Secure. type=8, code=0, id=1, seq=7896." id=20085 trace_id=4543 func=resolve_ip_tuple_fast line=5572 msg="Find an existing session, id-0000cd58, original direction" id=20085 trace_id=4543 func=npu_handle_session44 line=1105 msg="Trying to offloading session from VLAN_Secure to npu0_vlink1, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x00000000" id=20085 trace_id=4543 func=__ip_session_run_tuple line=3328 msg="SNAT 172.4.255.10->172.4.255.1:60417" id=20085 trace_id=4544 func=print_pkt_detail line=5497 msg="vd-VDOM_Secure:0 received a packet(proto=1, 172.4.255.10:1->172.3.255.10:2048) from VLAN_Secure. type=8, code=0, id=1, seq=7897." id=20085 trace_id=4544 func=resolve_ip_tuple_fast line=5572 msg="Find an existing session, id-0000cd58, original direction" id=20085 trace_id=4544 func=npu_handle_session44 line=1105 msg="Trying to offloading session from VLAN_Secure to npu0_vlink1, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x00000000" id=20085 trace_id=4544 func=__ip_session_run_tuple line=3328 msg="SNAT 172.4.255.10->172.4.255.1:60417"

[smari]

hmm, can you post the config of the routes and vlink.

[kzuk]

Sure, i can post whole config.

[smari]

try removing the gw address on the vlink static route ( set it as 0.0.0.0 ) and check the flow again.