VDOM (Virtual Domains ) administration

[Mallam]

We are currently checking how we can administrate VDOM for each customer. In our standard design, we need one @IP for

each VDOM, that mean we need 100 IPs for production and 10IPs maximum for Preproduction.

In which way could we used private IP for that administration ? Our concern is managing overlap with customer. How customer IP plan is managed ? If we give you one subnet, are you able to say us if we can use it for our administration ?

[Toshi_Esumi]

You just need to say all customers a subnet or some muliple subnets are reserved for management before you sell your services. Nothing different from the situation when you install one router to each customer and you manage all of them remotely.

[Mallam]

First Thanks for you support

 i am Not sure to well catch the answer, platform is already in place and therefore subnet for customer are assigned.

I don’t know how it work for new customer, who assign that subnet …

Just i need more Clarification ( More Details ) 

I appreciate your prompt Reply

[Mallam]

the request is for new IP addresses – how assigns those?  Can you help with that query?  I assume this is for new infrastructure for the new design.

[Toshi_Esumi]

Many way you can in addition to existing IPs/subnets at each vdom (same as a router), like a loopback interface, a secondary IP on an existing interface, adding a vlan interface, and so on. But the main issue is routing to reach them.

[Mallam]

This is not for an IPVPN connection, this will be for the firewall infrastructure similar to what we have now with our Solutions

Please Just we need which way could we used private IP for that administration ? Our concern is managing overlap with customer.

Also If we give you one subnet, are you able to say us if we can use it for our administration ?

[emnoc]

It was already mention, assign a /32 loop and redistribute into OSPF. place a policy to allow  access to it in  each vdoom and set the allowaccess for ssh|https|snmp or what ever you want. That's how we do it. Now the customer can manage his her access rules to allow the access. 

We have ruels in X vdom that our operation staff can access and with the access rule, the customer has audit log when we hit that rules. So our Nagios host is doing simple checks to this loop0 and it's address and all of the ops and soc staff access via that same loop0 interface.

Ken Felix

[Toshi_Esumi]

By the way, just to "administrate VDOM" as mentioned originally, you don't need to have any IP in each vdom. As long as you're "super_admin" regardless which vdom's interface you use to log in, you can configure/monitor/debug/sniff via CLI or GUI at all vdoms as well as at global. That's the difference between 10 vdoms on one FGT and 10 routers physically racked up at a datacenter for 10 customers.

[Mallam]

what is required is an IP addressing plan for the new design ?? regarding IP plan, can we use what we want for our administration ?