Multiple VDOMs over same Physical Links

[OliverW]

Hi,

We have a Fortigate 600D and would use the two 10Gbit ports for connecting to our network.

Over this two Ports (in link aggregation mode) i need to communicate with three VDOMs (VLAN-based).

So my idea was to create the trunk in the root-vdom (named rootTrunk) and create an VLAN-Interface on this trunk (named Trunk_VLAN20).

So i have create it and assigned an ip address to the interface Trunk_VLAN20 and (yeah!) can ping the IP from a Client in VLAN20.

Now i would like to move the ip adress to the correct vdom behind the root-vdom by create a VDOM Link between root-vdom and vdom_1. Also i create a VLAN interface on npu0_vlink0 (port for root-vdom named vlink0_20) and a VLAN interface on npu0_vlink1 (Port for vdom_1 named vlink1_20).

After this i assign the ip adress to virtual port vlink1_20.

this was not possible to ping.

Thus i think thats was a problem in root-vdom by a missing policy. Now i create a policy (in root-vdom) from Trunk_VLAN20 to vlink0_20 with access for ICMP.

But that is also not possible to ping it from my Client.

Anyone have a idea where my mistake? So this is general possible on this way? For a better view i have a a screen.

[Toshi_Esumi · Accepted solution]

Fortigate's vlan interface is a subinterface of one parent interface. You can't span out a vlan through multiple interfaces unless you aggregate them into one interface.