Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kzuk
New Contributor

Fortigate VDOMs instead two CISCO routers

Hi,

 

I have used two CISCO routers so far.

The first router provided access to the internet and for the first segment of the network. Behind this router was a second one (behind NAT), which was a network separator. I would like to implement this configuration on one Fortigate 100E. I have already created two VDOMs but I am not sure if I should use VDOM Links or something else.

 

16 REPLIES 16
ede_pfau
SuperUser
SuperUser

If you want to go that way VDOM links would be natural to use. The only other setup would be to assign some physical ports to each VDOM and connect them via external cable. Which, in comparison, is not only less elegant but VDOM links might offer more bandwidth on top.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Toshi_Esumi

FYI: you can find the configuration in online help.

https://help.fortinet.com...t=inter-vdom%20routing

oliviahuffman
New Contributor

nice thank you for sharing!!

kzuk

Ok, i have problem. I have configured FortiSwitch with FortiGate. VDOMs configured with VLAN interfaces (FortiSwitch).

 

I set static routes on both VDOMs and can't send any packets between VDOMs.

 

Policies configured on both VDOMs and while i try to ping other side i see activity but only on current VDOM.

 

Communication within VDOM is OK. I have problem with route between VDOMs.

smari
New Contributor

what does your debug flow say ?

NSE7, FMG, FAC, FAZ .

1500D's, 1200D's, 900D's, 300D's, 200D's, 100D's and bunch of small stuff.

 

NSE7, FMG, FAC, FAZ . 1500D's, 1200D's, 900D's, 300D's, 200D's, 100D's and bunch of small stuff.
kzuk
New Contributor

Ping from VDOM to another. 

 

VDOM_Public: one host with IP 172.3.255.10

VDOM_Secure: one host with IP 172.4.255.10

 

Pinging from 172.4.255.10 to 172.3.255.10. 

 

Policies set to ALL services.

 

diagnose debug enable 

diagnose debug flow filter proto 1

diagnose debug flow show function-name enable

diagnose debug flow trace start 20

 

id=20085 trace_id=4541 func=print_pkt_detail line=5497 msg="vd-VDOM_Secure:0 received a packet(proto=1, 172.4.255.10:1->172.3.255.10:2048) from VLAN_Secure. type=8, code=0, id=1, seq=7894." id=20085 trace_id=4541 func=init_ip_session_common line=5657 msg="allocate a new session-0000cd58" id=20085 trace_id=4541 func=vf_ip_route_input_common line=2591 msg="find a route: flag=04000000 gw-172.3.255.10 via npu0_vlink1" id=20085 trace_id=4541 func=fw_forward_handler line=751 msg="Allowed by Policy-2: SNAT" id=20085 trace_id=4541 func=__ip_session_run_tuple line=3328 msg="SNAT 172.4.255.10->172.4.255.1:60417" id=20085 trace_id=4542 func=print_pkt_detail line=5497 msg="vd-VDOM_Secure:0 received a packet(proto=1, 172.4.255.10:1->172.3.255.10:2048) from VLAN_Secure. type=8, code=0, id=1, seq=7895." id=20085 trace_id=4542 func=resolve_ip_tuple_fast line=5572 msg="Find an existing session, id-0000cd58, original direction" id=20085 trace_id=4542 func=npu_handle_session44 line=1105 msg="Trying to offloading session from VLAN_Secure to npu0_vlink1, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x00000000" id=20085 trace_id=4542 func=__ip_session_run_tuple line=3328 msg="SNAT 172.4.255.10->172.4.255.1:60417" id=20085 trace_id=4543 func=print_pkt_detail line=5497 msg="vd-VDOM_Secure:0 received a packet(proto=1, 172.4.255.10:1->172.3.255.10:2048) from VLAN_Secure. type=8, code=0, id=1, seq=7896." id=20085 trace_id=4543 func=resolve_ip_tuple_fast line=5572 msg="Find an existing session, id-0000cd58, original direction" id=20085 trace_id=4543 func=npu_handle_session44 line=1105 msg="Trying to offloading session from VLAN_Secure to npu0_vlink1, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x00000000" id=20085 trace_id=4543 func=__ip_session_run_tuple line=3328 msg="SNAT 172.4.255.10->172.4.255.1:60417" id=20085 trace_id=4544 func=print_pkt_detail line=5497 msg="vd-VDOM_Secure:0 received a packet(proto=1, 172.4.255.10:1->172.3.255.10:2048) from VLAN_Secure. type=8, code=0, id=1, seq=7897." id=20085 trace_id=4544 func=resolve_ip_tuple_fast line=5572 msg="Find an existing session, id-0000cd58, original direction" id=20085 trace_id=4544 func=npu_handle_session44 line=1105 msg="Trying to offloading session from VLAN_Secure to npu0_vlink1, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x00000000" id=20085 trace_id=4544 func=__ip_session_run_tuple line=3328 msg="SNAT 172.4.255.10->172.4.255.1:60417"

smari
New Contributor

hmm, can you post the config of the routes and vlink.

NSE7, FMG, FAC, FAZ .

1500D's, 1200D's, 900D's, 300D's, 200D's, 100D's and bunch of small stuff.

 

NSE7, FMG, FAC, FAZ . 1500D's, 1200D's, 900D's, 300D's, 200D's, 100D's and bunch of small stuff.
kzuk
New Contributor

Sure, i can post whole config.

 

 

 

smari
New Contributor

try removing the gw address on the vlink static route ( set it as 0.0.0.0 ) and check the flow again.

NSE7, FMG, FAC, FAZ .

1500D's, 1200D's, 900D's, 300D's, 200D's, 100D's and bunch of small stuff.

 

NSE7, FMG, FAC, FAZ . 1500D's, 1200D's, 900D's, 300D's, 200D's, 100D's and bunch of small stuff.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors