Skip to main content
prince
prince
New Member
Jun 7, 2024 1:31 PM UTC
Solved

VDOM configuration

We need to configure Vdom for our project. but we have only one isp provider.ISP given /30 and /29 ip address. we configured /30 ip with fortigate firewall wan interface and created vlan1 in cisco switch and its worked fine. for vdom wan interface, we need to use this /29 ip address so I create one interface with this ISP /29 Ip address and configured as lan and connect this with cisco switch as vlan 2 and created the policy from vlan2 to wan(/30 ip address) and disabled the NAT and its worked fine. and from another vlan2 interface in switch connected to FortiGate firewall I configured as wan ip address with this /29 ip address and create a separate lan interface Vlan3 for the vdom and created a policy for this and its worked.

but in vdom wan ip address /29 ip address, we cant able to access this interface ip address from remote and ssl and ip sec vpn is also not connecting from rem ote network. but sslvpn can connect when the the laptop is in vlan3 segment. i need to know whether this configuration is wrong if yes, then how i can use /29 Ip address with vdom wan interface and need to access ssl vpn with this vdom network.

Toshi_Esumi
Toshi_EsumiAnswer
SuperUser
Jun 12, 2024 6:35 AM UTC

If you NAT just like in my diagram, only static routes you would need is default route at root vdom and test vdom to the other side of the interfaces.
Again, test with ping&traceroute&sniffer and find where the breaking point is. It doesn't take a rocket scientist to figure it out yourself.

It wouldn't affect to ping out but at the root vdom you need to have another policy for out-to-in direction without NAT. Otherwise, nobody on the internet can reach the test vdom interface IP.

Toshi

View in thread

8 replies

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
Jun 7, 2024 3:24 PM UTC

Unless those two /30 and /29 subnets are assigned to two different physical (or logical like different VLANs on the same circuit) circuits by the ISP, the traffic to any IP to the /29 IPs are routed through the /30 interface IP. And the ISP expects the traffic from the /29 IPs are coming over the /30 interface IP. This means to route trafffc into/out of a new VDOM, you have to use either vdom-link or npu-vlink. Unless your FGT is old entry class modesl, like 30E, 50E, your FGT should have at least one NPU built-in. So no reason to use vdom-link (npu-vlink is much faster).
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Difference-and-understanding-between-NPU-Vdom-link/ta-p/212709
You can create as many links as you want as VLAN subinterfaces on top of npu0_vdom0/1 interface.


You should draw a diagram like below, which I drew for another post in this forum some time ago.
vdoms.png

 

In my diagram, you can terminate SSL VPN at both 1.1.2.1 and 1.1.2.3 for two client VDOMs.
And obviously you need to split the /29 to multiple /31s for the npu_vlink.

Toshi

    prince
    princeAuthor
    New Member
    Jun 11, 2024 1:54 PM UTC

     

    Hi Thanks for your variable support. sorry to disturb you again. as per your post. i have created new vdom interface under global - vdom and create a vdom named as Test. and in the global network interface, in the NPUVDOM link. under the npu_vlink0( Test npu0) I created an interface and created vlanid4 and in virtual domain I pointed to root and in the address mode I assign the ip address to 1.2.2.4/31 and enabled the status. same in npu_vlink1(test npu1) I created vlanid4 and in virtual domain I pointed to the created vdom ie Test.and assigned the IP address 1.2.2.5/31. and in vdom network I created a lan interface in port No 5 and assigned the ip address 10.1.0.10/24.

    and I created a policy in the vdom test. for incoming port  is port No 5 to outgoing port to the created npu_vlink1(test npu1) and I allowed all to source and destination and enabled nat.
    and same I created the policy in root, incoming port is npu_vlink0( Test Npu0) to wan ip address( which is /30 ip address) and I allowed all for source and destination and enabled Nat.

    now I created static route in vdom test by pointing the gateway to 1.2.2.4 and interface as (Testnpu1).

    but when I connect the laptop in vlan 4 segment internet is not working. can you guide me.

    ISP provided IP 1.2.2.4/29.and 1.2.3.0/30
    I have spitted /29 Ip in to 1.2.2.4/31 and 1.2.2.5/31

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    Jun 13, 2024 2:57 PM UTC

    As I said before, did you crate a policy at root vdom from physical wan interface to npu_vlink0? Otherwise nobody can reach/ping npu_vlink1 IP from the internet.
    You would see it's coming in from wan interface but never hit npu_vlink0 when you sniff like "diag sniffer packet any 'icmp and host npu_vlink1_IP' 4 0 l (last letter is lower case 'L')".

    Toshi

    Terms & ConditionsAccessibility statement
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT