VDOM setup or FortiManager setup

[IrbkOrrum]

I have a single, 8 hour, professional services support day banked.  I've got a couple of options on how to use it.  I've got a FortiManager license but I've never set it up and never used it.  I would also like to configure my FortiGate that's in my DR site with a VDOM so that I could have a "bubble test" that's segregated from everything else, but uses Corp IPs.  I've also never set up VDOMs or worked with VDOMs.  I'm less than sure I can accomplish both of these tasks in 1 8 hour support day.  
Which one would you consider more complicated and I should use the support day for?

[DPadula]

Hi IrbkOrrum,

Setup a vdom is not that complicated. Once you understand the concept you will realise how easy it is. 

• First thing to do is enable multi-vdom on your Fortigate, this can be done using the article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-multiple-VDOMs/ta-p/193601
• This other article shows how to create vdoms, it has some examples that are helpful https://community.fortinet.com/t5/FortiGate/Technical-Tip-Step-by-Step-Inter-VDOM-configuration-exam...

FortiManager setup can be a little bit more trick on my point of view, but also can be done using Fortinet documentation https://docs.fortinet.com/document/fortimanager/7.6.1/administration-guide/512210/setting-up-fortima...

I suggest to have a look on three links before you decide how you want to use your PS hours. 

Regards

DPadula

[IrbkOrrum]

Let me further expound upon what I want to do with a VDOM because I can't figure out how I'm going to accomplish it myself with what I've read.

The FortiGate that's going to be in our DR site will have 2 connections to it.  

Port 5 goes to the internet
Port 1 goes to the VMWare stack
These are all the physical connections I can have (hosted data center, each connection costs me $).
I would want to set up (I guess) 2 VDOMs.  There is the "Primary DR" which will have subnets like 10.8.10.0/24 - 10.8.20.0/24, each as a vlan interface under Port 1.
Then there is the "Bubble Test" VDOM.  This will also run the same subnets 10.8.10.0/24 - 10.8.20.0/24, they also need to be vlan interfaces under Port 1 (because I only have the 1 port) however they will be different vlan IDs.  
"Primary DR" and "Bubble Test" VDOMs should have no communication.  "Bubble Test" will have clients using an SSLVPN to connect to it and once connected have no access to anything else except what's in the "Bubble Test" VDOM, not even internet access.  
It's the sharing of ports that I am lost in right now.  Everything keeps saying "assign a physical interface to the vdom" but I'm not understanding how "Primary DR" and "Bubble test" vdoms would share the same interface.  

[DPadula · Accepted solution]

Hi IrbkOrrum,

So you will have 3 vdoms, Primary, Blubble and root. You cannot get rid of root, this is by default. 

Then you need to create each vlan interface like the settings below.

VLAN 1001

and VLAN 2001

Create the other vlans interfaces as your diagram, I have just created two of them, one on each vdom, to show you how it is done.

After that, the Network-Interface menu will look like this one:

The physical interface belong to root (default) but the vlans interfaces belong to Primary or Bubble, according to your configuration. 

I hope it helps. 

[IrbkOrrum]

Ahhh, ok.  That's actually a lot more simple than I thought it was.  So I've already got a config and when I turn on the VDOMs all my rules fall under "Root".  I think I'll take a backup and then modify the backup to move those interfaces from "Root" to the "Primary_DR".  

[IrbkOrrum]

I figured out that you've got to create those interfaces under the global vdom.  I've figured out how to manipulate a backup config file so that all my existing rules that automatically get moved to "root" can end up under "Primary_DR" where I would like them.  However, I'm lost on the routing.  How do I route either of the non-root VDOMs to port5?  It's not an option when I go to create a static route.  The only VDOM that even sees port5 is the root vdom.  Likewise, I'm not sure how P2P IPSec VPN tunnels would work as the VDOMs don't see the "outside" interface.  Is this where I need to create the Inter-VDOM links explained in the link supplied earlier?  Then my "outside" interface for each VDOM becomes the link between the specific VDOM and the "Root" VDOM?

[DPadula]

IrbkOrrum

If you have a bunch of vlans under the same physical interface you will need a device connected to such interface capable of handling all the vlan traffics (vlan tags). I used port5 to show you how to do it but I believe you will do under port1, right?

You can use inter-vdom links to connect each vdom to each other in case each vdom need to communicate with other vdom.

I hope I clarified instead of make it more confusing. :)

[IrbkOrrum]

Ok, so the individual vlan interfaces are set up under global, with the vlan interface being called out as belonging to an individual VDOM there.  That makes sense for the inside interfaces.  However, how do you share like 1 single outside interface?  Would Root have the outside interface in it's vdom with the routing assigned at the Root VDOM.  Then like Primary_DR and Bubble_Test would each have an inter VDOM link to root?  How does Root know to route traffic to Primary_DR or Bubble_Test?  Like Primary_DR will have IPSec VPN connections, but Bubble_Test will just have SSL VPN. 
It seems like VDOMs are easy if you are assigning a physical interface to each vdom and there are several videos that I've found on youtube explaining that.  However, when all the VDOMs share physical 1 ingress and physical 1 egress things get a lot muddier and I can't find any good documentation or videos on it. 

[IrbkOrrum]

I've got an old FortGate 50E.  I was able to get it upgraded to 6.2.16 and turn on vdoms.

I created the VLAN interfaces under 1 physical interface.  The Vlan interfaces all have different VLAN IDs but each VDOM has the same IP addresses (which is what production will look like).

I then created the inter-vdom link between Root<>Primary, using 1.1.1.1/30 for root and 1.1.1.2 for Primary.  Then I created the inter-vdom link between Root<>Bubble using 1.1.1.5/30 for root and 1.1.1.6/30 for primary.

Under the Root VDOM I created routes for the 10.81.10.0/24 network to both Primary and Bubble.

Under the Primary VDOM I created a static default route to 0.0.0.0/0 using the 1.1.1.1 gateway IP and the Inter-vdom link as the interface.

Under the Bubble VDOM I created a static default route to 0.0.0.0/0 using the 1.1.1.5 gateway IP and the Inter-vdom link as the interface.

I created firewall rules under each vdom allowing traffic.

Boom..... It works!

I don't understand HOW it works though?  How the heck does the Fortigate know which 10.81.10.0/24 network to route too? I mean there is some serious black magic going on.  It's kind of neat and you're totally right, not all that difficult to set up (if you have the hardware to set it up and play with).

[DPadula]

I won't use 1.1.1.x on vdom links. The reason why they are public IP addresses in use (you can ping 1.1.1.1, 2. 3 - APNIC and Cloudflare DNS Resolver project).

You should use a private IP ranges for transport networks. So choose a /24 that you are not planning to use, divide in /30 subnets and replace the 1.1.1.x/30 assigned. 

Regarding your setup, root vdom does not know which 10.81.10.0/24 you are referring to. You can run 'diag sniffer packet any "host 10.81.10.x and icmp" (replace x by the ip address assigned) on root vdom and you will figure out which vdom the traffic is being sent (Primary or Bubble).