Question: two Vdom vlans to the same port ( native and allowed)

[mehmet]

Hi there. I have a question 

Let's say I have a root vdom and vdom2 as a secondary vdom.

Root vdom has own vlans under fortilink and connected to the fortiswich with fortilink.

Vdom2 also has a vlan which is part of root vdom's fortilink and fortiswich's port1 configured as shown in the link below

https://docs.fortinet.com/document/fortiswitch/7.0.0/devices-managed-by-fortios/801172/multitenancy-...

The problem with that setup the port is dedicated to vdom2.

What I want is share that port with the root vdom.

Example: 

port 1 native vlan for root vlan10

Port 1 Allowed vlan for Vdom2 vlan20

Any idea or advice for this will save my life. Thank you very much in advance.

[pciurea]

Hello Mehmet

Interface to VDOM implementation allows you to map unique interfaces (physical or virtual) to different VDOMS. In your example port1 would have a child virtual interface ( Vlan20) that can be mapped to a vdom that is different from the one that is mapped for that parent interface (port1). FortiOS does not care about interface relationship, as long as different interfaces are created/defined. If interface is already created, be aware that to move an interface from a vdom to another you need to first delete all the references .

Hope this helps,

Petre

[mehmet]

Vlans are already part of fortilink interface. I just wonder if it is possible to link these two Vdom Vlans as a native and allowed together on the managed switch port 1 like drawing below example.

[sachitdas_FTNT · Accepted solution]

Hi Mehmet,

No need to move the port to a different vdom. Have the port on root vdom and then map the vlans from FGT CLI root vdom:

FG (root) # config switch-controller managed-switch

FG (managed-switch) # edit <FSW serial#>

FG (S248E) # config ports

FG (ports) # edit port1

FG (port1) # set vlan 10

FG (port1) # set allowed-vlans vlan20

FG (port1) # end

[mehmet]

Thank you so much. It worked

[rachik-yaich]

Hello,

I have slightly different situation: the FortiGate has two VDOM and it has a managed switch through a Fortilink Aggregate, all the VLANs on this Fortilink are part of the root VDOM except one lets name it VLAN100 I added this VLAN manually in the allowed VLAN of the fortilink interface along with the other VLANs from root VDOm but every time I do an upgrade of the switch or the firewall this VLAn is lost again and I need to re-add it manually

the managed switches only pull the allowed VLANs that are configured in the root VDOM and ignore the VLAN which is configured in the secon VDOM.

Not sure why the list is not pulled from the global config instead this way the config will be stable

[CarlosCalvin]

To achieve the desired configuration of sharing a port between the root VDOM and VDOM2 with different VLANs, you can set the port as a trunk port on the FortiSwitch. Configure the port1 as a trunk port and set the native VLAN to VLAN10 for the root VDOM. Additionally, allow VLAN20 for VDOM2 on the same trunk port. By doing so, the port will carry traffic for both VLANs simultaneously, allowing the root VDOM to use VLAN10 as the native VLAN and VDOM2 to use VLAN20 as an allowed VLAN. This configuration will enable you to share the port between the two VDOMs with different VLAN settings. Remember to apply the necessary configuration changes to both the FortiSwitch and the associated VDOMs.