VDOM Basics

[Larry_Dunn]

Apologies if this question seems too simple but I'm confused by the exact nature of a FortiGate VDOM.

1) On a Fortigate (in this case a FG1000D) if you create two separate VDOMS must you assign a separate physical Fortigate port (or ports) - plus separate cables to other network devices - to each VDOM?

or

Can you just, in it's simplest case with 2 separate VDOMs - have one physical port (for example, either one of the two 10GB SFP+ ports or an RJ45 1GB Ethernet port) plugged into the physical FG1000D and then virtually assign different interfaces to each VDOM?

(I guess what I'm asking is from the physical FG100D do you have to associate at least one physical port and cable to each VDOM?)

2) My second question is - what's the relationship, if any, between a 'VRF' and a FortiGate VDOM?   

[aagrafi]

1) Not necessarily. You may assign physical or logical interfaces (like VLANs) to VDOMs. For example, you can do the following configuration:

edit "port5"   set vdom "root"   set type physical next edit "VLAN-1"   set vdom "root"   set ip ...   set interface "port5"   set vlanid 100 next edit "VLAN-2"   set vdom "other"   set ip ...   set interface "port5"   set vlanid 200 next

2) Different concepts, but you achieve the same functionality (almost), e.g having multiple routing instances in the same box. A key difference is that VRF (or VRF lite) is a standards based protocol, whilst VDOM is strictly Fortinet and stays inside the box.

Hope that helps.

[Larry_Dunn]

Many thanks aagrafi for your reply.

Just clarification on point 1 -

a) I assume that you can assign more than one 'vlanid' to each VDOM?

b) Is there a limitation on the number of 'vlanids' which can be assigned to each VDOM?

Again, many thanks for your assistance as I'm getting to grips with networking concepts :=]

[aagrafi]

a) Yes, you can have multiple VLANs in the same VDOM.

b) There are VLAN limitations, but not per VDOM. These are: the maximum number of VLANs is 4094 as per 802.1Q protocol. Also the FG 30D and 30E series has a limitation of 20 VLAN per interface. You may refer to the max value document for more info http://help.fortinet.com/fgt/54/max-values/5-4-0/max-values.html.

[Larry_Dunn]

Many thanks aagrafi