Vdom configuration - Transparent to NAT

[ASR]

Hi support, I'm unsure if this is feasible, but I have two VDOMs: one named ROOT, configured with NAT for internet connectivity, and another named TEST in transparent mode, encompassing all local VLANs.

I've established a VDOM link to successfully forward traffic from TEST to ROOT, allowing internet access from the firewall itself.

However, I'm wondering how I can enable internet access from the VLANs behind TEST and determine the appropriate gateway.

May be possible this configuration? Any suggestion?

Thanks,

[hbac]

Hi @ASR,

I believe you can create a firewall policy on the TEST vdom to allow traffic from those VLANs to vdom link. 

Regards, 

[AEK]

Hi ASR

I guess the default gateway of your VLANs is on some L3 switch, right? If so, you have to add a default gateway on the L3 switch's routing table that points to the VDOM link's IP, then add firewall policy as suggested by @hbac .

On the other hand you need to add routes on the root VDOM so it can reach the internal VLANs through the VDOM link.

[ASR]

Thanks to both of you for the suggestions.

@AEK  is correct; the gateway for each VLAN is on the L3 switch. Now, do I need to add the default gateway on the switch?

I can set an IP only to the VDOM (NAT - "root") link, and obviously not on the VDOM (Transparent - "Test").

Should my 192.168.198.1 on the link interface be reachable from the L3 switch connected to the L2 VDOM?

Below is an idea of the schema.

 Thanks,

[AEK]

Yes you are right, there is no IP on transparent VDOM link, but from NAT VDOM side only, and your the GW IP on NAT VDOM link should be visible by your L3 switch, and that IP (192.168.198.1) should be the default gateway of your L3 switch.

The below tech tip is for connecting two transparent VDOMs through a NAT VDOM but it may help you to setup your FG.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Connect-2-Transparent-VDOMs-with-NAT-VDOM-...