Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
IrbkOrrum
New Contributor III

Security Profiles in VDOMs when all traffic runs through the Root.

I've got a couple of VDOMs set up using a shared internet connection through Root.  Root has to have firewall policies to allow/foward/nat the traffic from the VDOMs to the internet.  I will have the security profiles implemented at the individual VDOM level so does it make any sense to have the same security profiles enabled on the Root VDOM firewall rules?  Seems to me like it would just be wasting system resources.  Basically would be checking traffic that's already been checked. Thoughts?  I'm thinking no security profiles at the Root VDOM, just rely on the individual VDOMs security profiles. 

1 Solution
Toshi_Esumi
SuperUser
SuperUser

I would agree to your idea. In your set up, the root vdom is a separate NAT router in front of FW(vdom)s. We do NAT in multivdom setup (vdom per customer) at customer vdom, where each customer has own public IP(s). So root vdom is just an internet router routing public IPs from/to internet to/from all vdoms. There are only two policies in root vdom with zones in-to-out and out-to-in without any inspection.

Toshi

View solution in original post

6 REPLIES 6
Toshi_Esumi
SuperUser
SuperUser

I would agree to your idea. In your set up, the root vdom is a separate NAT router in front of FW(vdom)s. We do NAT in multivdom setup (vdom per customer) at customer vdom, where each customer has own public IP(s). So root vdom is just an internet router routing public IPs from/to internet to/from all vdoms. There are only two policies in root vdom with zones in-to-out and out-to-in without any inspection.

Toshi

IrbkOrrum

Thanks, good to know I'm not not only one thinking that.

sjoshi
Staff
Staff

you can use the security profile in the internet facing vdom where wan interface are part of and yes the same traffic is not required to do multiple inspection in each vdom as it will be resource intensive

Let us know if this helps.
Salon Raj Joshi
IrbkOrrum
New Contributor III

Yeah, in this case the inspection will be done at the "sub-VDOM" level and the Root VDOM will just pass the traffic without any inspection.

sjoshi

you are correct IrbkOrrum

Let us know if this helps.
Salon Raj Joshi
dingjerry_FTNT

Hi @IrbkOrrum ,

 

If you have applied Security Profiles at VDOM level, there is no need to apply them again in the root VDOM.

Regards,

Jerry
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors