Site-to-site VPN between Fortigate 1100E and Meraki MX firewall

[akomili]

Hello

We're going to be setting up a S2S VPN tunnel between our FG 1100E in our production data center and a Meraki MX firewall at one of our branch sites for sending backups. The FG is in multi-VDOM mode, with the WAN connection being in a transparent vWire configuration. What's best practice in terms of which VDOM to put the S2S VPN tunnel in? Since the WAN VDOM is operating in transparent mode I assume doing any kind of routing there is not an option. Are there any downsides of putting the tunnel in a separate VDOM?

Thanks

[emnoc]

Why the transparent vdom to begin with? Sounds like youre making it more complex and you surely can't control traffic already encapsulated in IPSEC via the transparent-vdom.

Ken Felix

[akomili]

That's a good question. It was set up like this before I got involved so I'm not sure. Does this complicate things a lot? What setup would you recommend?

[emnoc]

Will that depends are you doing multiple NAT/routed domains?

Do you really need a stack-multi-vdom where you run other vdom thru a primary vdom?

Ken Felix

[akomili]

Likely not, I don't think we have a reason for separating out into different VDOMs. Perhaps we need to take a step back and re-evaluate the bigger picture. We're going to be moving all of our routing off our old firewalls onto these, the transparent mode setup was just a temporary solution for the evaluation and to give us IPS at the perimeter. We want to keep things simple so if a single VDOM is the way to go then we can do that. We have a secondary unit that we can reconfigure rather than messing with the production unit if needed. If there is a way to get the S2S up and running in it's current state though that would be great.

[emnoc]

You can run IPS in nat/routed mode fwiw.  But yes, you could set a 2nd unit up and deployed. Stack vdom do have purpose but typically you have a need.If you do have a need for emac and sharing a interface within multiple vdom please review this article 

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/212317/enhanced-mac-vlans

Ken Felix