VDOM and 40C

[JaapHoetmer]

Hi there Does anyone know why VDOMs are no longer available in the combination FortiOS 5+FortiGate 40C? I could not find the information anywhere other than a remark in this forum that it is no longer available, but it would be interesting to know before I downgrade my 40C... Thanks

[emnoc]

How are you trying to enable vdoms? btw: the fortigate 40C is one of the smallest fgt and if you need vdoms, in a SOHO gear, you might be using the appliance for the wrong need. IIRC the product sheet shows 10/10 default/max in this model, but I would hate to see the network that needs 10 vdoms in this model

[Dave_Hall]

I have also checked the product matrix guide (revised Dec 2012) and it still shows 10/10 VDOMS. The update notes for FortiOS 5.x doesn' t indicate anything missing VDOM wise from the 40C either.

[JaapHoetmer]

I only need to enable two VDOMs and the manual says it supports it, so I was wondering why in version 5 the 40C no longer does. I have followed the handbook at http://docs.fortinet.com/fgt/handbook/50/fortigate-vdoms-50.pdf but neither the GUI nor the console commands to enable VDOMs are accessible. I can apparently only create VLANs, using console commands. Which means the VDOM handbook is wrong. From the guide: The information in this guide applies to all FortiGate units. All FortiGate models except the FortiGate-30B model support VDOMs, and all FortiGate models support VLANs.

[Dave_Hall]

Have confirmed by upgrading the firmware on my little Wifi 40C that fortinet has disabled all VDOM support under FortiOS5.x. What I did... 1. Upgraded the firmware to 4.0MR 3-patch 10. 2. Performed a factory reset. 3. Enabled VDOMS. 4. Upgraded to 5.1 (patch 1). 5. Received several errors on the console (see below). 6. Performed a factory reset. 7. Attempted to enable VDOMs -- discovered no VDOM support commands exist at the CLI level. 8. downgraded the firmware back to 4.0MR3-patch10. Shame that...I originally purchased the Fortiwifi 40C because it was the only low-end model with VDOM support. Looks like I will not be upgrading this unit to firmware 5.0x. BTW noticed from factory reset, FortiOS5.0 eats up 10% more memory than 4.0MR3-patch10.

 
 FWF40CXXXXXXXXX login:
 Checking new firmware integrity ... pass
 
 
 Firmware upgrade in progress ...
 Done.
 
 
 The system is going down NOW !!
 
 Please stand by while rebooting the system.
 Restarting system.
 ü
 
 FortiWifi-40C (11:21-11.28.2011)
 Ver:04000004
 Serial number: FWF40CXXXXXXXXX
 CPU(00): 525MHz
 Total RAM: 512MB
 Initializing boot device...
 Initializing MAC... nplite#0
 Press any key to display configuration menu...
 ......
 Reading boot image... 1705021 bytes.
 Initializing firewall...
 
 System is starting...
 Too many entries in all tables of .vpn.ssl.web.portal in vdom root: 1 / vdom-max = 1
 Too many entries in all tables of .vpn.ssl.web.portal in vdom root: 1 / vdom-max = 1
 Too many entries in all tables of .endpoint-control.profile in vdom root: 1 / vdom-max = 1
 Too many entries in all tables of .endpoint-control.profile in vdom root: 1 / vdom-max = 1
 Too many entries in all tables of .endpoint-control.profile in vdom root: 1 / vdom-max = 1
 The config file may contain errors,
 Please see details by the command ' diagnose debug config-error-log read' 
 
 
 FWF40CXXXXXXXXX login: admin
 Password:
 Welcome !
 
 FWF40CXXXXXXXXX # diag debug config-error-log read
 >>>  " set"  " vdom-admin"  " enable"  @ global.system.global:command parse error (error -61)
 >>>  " set"  " wanoptgrp"  " read-write"  @ global.system.accprofile.prof_admin:command parse error (error -6                                                                                                                                      1)
 >>>  " config"  " system"  " replacemsg"  " webproxy"  " deny"  @ global:command parse error (error 1)
 >>>  " config"  " system"  " replacemsg"  " webproxy"  " user-limit"  @ global:command parse error (error 1)
 >>>  " config"  " system"  " replacemsg"  " webproxy"  " auth-challenge"  @ global:command parse error (error 1)
 >>>  " config"  " system"  " replacemsg"  " webproxy"  " auth-login-fail"  @ global:command parse error (error 1)
 >>>  " config"  " system"  " replacemsg"  " webproxy"  " auth-authorization-fail"  @ global:command parse error (                                                                                                                                      error 1)
 >>>  " config"  " system"  " replacemsg"  " webproxy"  " http-err"  @ global:command parse error (error 1)
 >>>  " config"  " wanopt"  " storage"  @ global:command parse error (error 1)
 >>>  " config"  " firewall"  " shaper"  " traffic-shaper"  @ root:command parse error (error 1)
 >>>  " edit"  " web-access"  @ root.vpn.ssl.web.portal:failed command (error -4)
 >>>  " edit"  " tunnel-access"  @ root.vpn.ssl.web.portal:failed command (error -4)
 >>>  " set"  " group-type"  " fsso-service"  @ root.user.group.FSSO_Guest_Users:failed command (error -160)
 >>>  " set"  " options"  " https-scan"  @ root.webfilter.profile.default:failed command (error -160)
 >>>  " set"  " category"  " 32"  @ root.webfilter.profile.default.ftgd-wf.filters.11:value parse error (error                                                                                                                                       -600)
 >>>  " config"  " endpoint-control"  " app-detect"  " rule-list"  @ root:command parse error (error 1)
 >>>  " edit"  " Recommend_FortiClient"  @ root.endpoint-control.profile:failed command (error -4)
 >>>  " edit"  " Enforce_FortiClient_AV"  @ root.endpoint-control.profile:failed command (error -4)
 >>>  " edit"  " P2P_application_detection"  @ root.endpoint-control.profile:failed command (error -4)
 >>>  " config"  " https"  @ root.antivirus.profile.default:command parse error (error 1)
 >>>  " config"  " imaps"  @ root.antivirus.profile.default:command parse error (error 1)
 >>>  " config"  " pop3s"  @ root.antivirus.profile.default:command parse error (error 1)
 >>>  " config"  " smtps"  @ root.antivirus.profile.default:command parse error (error 1)
 >>>  " config"  " firewall"  " service"  " explicit-web"  @ root:command parse error (error 1)
 >>>  " config"  " wanopt"  " rule"  @ root:command parse error (error 1)
 >>>  " config"  " redistribute"  " connected"  @ root.router.rip:failed command (error 1)
 >>>  " config"  " redistribute"  " static"  @ root.router.rip:failed command (error 1)
 >>>  " config"  " redistribute"  " ospf"  @ root.router.rip:failed command (error 1)
 >>>  " config"  " redistribute"  " bgp"  @ root.router.rip:failed command (error 1)
 >>>  " config"  " redistribute"  " isis"  @ root.router.rip:failed command (error 1)
 >>>  " config"  " router"  " ripng"  @ root:command parse error (error 1)
 >>>  " config"  " redistribute"  " connected"  @ root.router.ospf:failed command (error 1)
 >>>  " config"  " redistribute"  " static"  @ root.router.ospf:failed command (error 1)
 >>>  " config"  " redistribute"  " rip"  @ root.router.ospf:failed command (error 1)
 >>>  " config"  " redistribute"  " bgp"  @ root.router.ospf:failed command (error 1)
 >>>  " config"  " redistribute"  " isis"  @ root.router.ospf:failed command (error 1)
 >>>  " config"  " redistribute"  " connected"  @ root.router.ospf6:failed command (error 1)
 >>>  " config"  " redistribute"  " static"  @ root.router.ospf6:failed command (error 1)
 >>>  " config"  " redistribute"  " rip"  @ root.router.ospf6:failed command (error 1)
 >>>  " config"  " redistribute"  " bgp"  @ root.router.ospf6:failed command (error 1)
 >>>  " config"  " redistribute"  " isis"  @ root.router.ospf6:failed command (error 1)
 >>>  " config"  " redistribute"  " connected"  @ root.router.bgp:failed command (error 1)
 >>>  " config"  " redistribute"  " rip"  @ root.router.bgp:failed command (error 1)
 >>>  " config"  " redistribute"  " ospf"  @ root.router.bgp:failed command (error 1)
 >>>  " config"  " redistribute"  " static"  @ root.router.bgp:failed command (error 1)
 >>>  " config"  " redistribute"  " isis"  @ root.router.bgp:failed command (error 1)
 >>>  " config"  " redistribute6"  " connected"  @ root.router.bgp:failed command (error 1)
 >>>  " config"  " redistribute6"  " rip"  @ root.router.bgp:failed command (error 1)
 >>>  " config"  " redistribute6"  " ospf"  @ root.router.bgp:failed command (error 1)
 >>>  " config"  " redistribute6"  " static"  @ root.router.bgp:failed command (error 1)
 >>>  " config"  " redistribute6"  " isis"  @ root.router.bgp:failed command (error 1)
 >>>  " config"  " redistribute"  " connected"  @ root.router.isis:failed command (error 1)
 >>>  " config"  " redistribute"  " rip"  @ root.router.isis:failed command (error 1)
 >>>  " config"  " redistribute"  " ospf"  @ root.router.isis:failed command (error 1)
 >>>  " config"  " redistribute"  " bgp"  @ root.router.isis:failed command (error 1)
 >>>  " config"  " redistribute"  " static"  @ root.router.isis:failed command (error 1)
 
 FWF40CXXXXXXXXX #
 Checking new firmware integrity ... pass
 
 
 Firmware downgrade in progress ...
 Done.
 
 
 The system is going down NOW !!
 
 Please stand by while rebooting the system.
 Restarting system.
 ü
 
 FortiWifi-40C (11:21-11.28.2011)
 Ver:04000004
 Serial number: FWF40CXXXXXXXXX
 CPU(00): 525MHz
 Total RAM: 512MB
 Initializing boot device...
 Initializing MAC... nplite#0
 Press any key to display configuration menu...
 ......
 Reading boot image... 1796255 bytes.
 Initializing firewall...
 
 System is started.
 The config file may contain errors,
 Please see details by the command ' diagnose debug config-error-log read' 
 
 
 FWF40CXXXXXXXXX login:
 

[emnoc]

May I direct you to the follow http://docs.fortinet.com/fgt/handbook/50/fortigate-max-values-50.pdf http://docs.fortinet.com/fgt/handbook/50/fortigate-vdoms-50.pdf Go the enabling vdom and let us know how your executing the vdoms. Also what does " get sys status" show you

[Dave_Hall]

I myself have already spent the evening going through the documents in question. Have actually flashed the 5.1 patch 1 firmware twice. Under 5.x, the Virtual Domain VDOMs allowed section is completely missing from the License Information. Executing...

config system global
 set vdom-admin enable
 end

Just returns an error message at " set vdom-admin enable" ... While in " config system global" , I issued a " set ?" doesn' t show any vdom commands.

FWF40CXXXXXXXXXX # get sys status
 Version: FortiWiFi-40C v5.0,build0147,121221 (GA Patch 1)
 Virus-DB: 16.00560(2012-10-19 08:31)
 Extended DB: 1.00000(2012-10-17 15:46)
 IPS-DB: 3.00249(2012-10-11 02:47)
 IPS-ETDB: 0.00000(2001-01-01 00:00)
 Serial-Number: FWF40CXXXXXXXXXX
 Botnet DB: 1.00000(2012-05-28 22:51)
 BIOS version: 04000004
 System Part-Number: P08928-05
 Log hard disk: Available
 Internal Switch mode: switch
 Hostname: FWF40CXXXXXXXXX
 Operation Mode: NAT
 FIPS-CC mode: disable
 Current HA mode: standalone
 Branch point: 147
 Release Version Information: GA Patch 1
 System time: Tue Jan  8 22:02:37 2013
 
 FWF40CXXXXXXXXXX #
 

[Dave_Hall]

No problems enabling VDOMS under MR3 Patch 10....

 FWF40CXXXXXXXXXX # get sys status
 Version: FortiWiFi-40C v4.0,build0639,120906 (MR3 Patch 10)
 Virus-DB: 14.00000(2011-08-24 17:17)
 Extended DB: 14.00000(2011-08-24 17:09)
 IPS-DB: 3.00150(2012-02-15 23:15)
 FortiClient application signature package: 1.131(2013-01-08 22:15)
 Serial-Number: FWF40CXXXXXXXXXX
 BIOS version: 04000004
 System Part-Number: P08928-05
 Log hard disk: Available
 Internal Switch mode: switch
 Hostname: FWF40CXXXXXXXXXX
 Operation Mode: NAT
 Current virtual domain: root
 Max number of virtual domains: 10
 Virtual domains status: 1 in NAT mode, 0 in TP mode
 Virtual domain configuration: enable
 FIPS-CC mode: disable
 Current HA mode: standalone
 Distribution: International
 Branch point: 639
 Release Version Information: MR3 Patch 10
 System time: Tue Jan  8 22:19:36 2013
 FWF40CXXXXXXXXXX #

FWF40CXXXXXXXXXX # get sys status Version: FortiWiFi-40C v5.0,build0147,121221 (GA Patch 1) Virus-DB: 16.00560(2012-10-19 08:31) Extended DB: 1.00000(2012-10-17 15:46) IPS-DB: 3.00249(2012-10-11 02:47) IPS-ETDB: 0.00000(2001-01-01 00:00) Serial-Number: FWF40CXXXXXXXXXX Botnet DB: 1.00000(2012-05-28 22:51) BIOS version: 04000004 System Part-Number: P08928-05 Log hard disk: Available Internal Switch mode: switch Hostname: FWF40CXXXXXXXXX Operation Mode: NAT FIPS-CC mode: disable Current HA mode: standalone Branch point: 147 Release Version Information: GA Patch 1 System time: Tue Jan 8 22:02:37 2013 FWF40CXXXXXXXXXX #

[Carl_Wallmark]

VDOMs have been removed from the 40C in FortiOS 5.0 The first model to support them is the 60C

[JaapHoetmer]

Thanks Dave, Selective, emnoc. I think Dave' s tests clearly indicated that VDOMs indeed have been removed for the 40C in Version 5. That poses two questions: - What was the reason behind the removal of the VDOM functionality for that particular combination? - Why wasn' t the documentation updated to reflect this? Is anyone from Fortinet available to answer this?