Virtual Domains - vdoms explanation

[Annex31]

Hello,

I'm a student and unfortunately can't afford some of the Fortigate devices. But i heard about the vdom feature.

Exactly a friend of mine told me that you can use two hardware devices (60D,90D ...) and put them in a vdom. Then for the clients it look like one single device. The real benefit is if one device crashes the other would do a failover transparently, so no client would see a service interruption.

Does anyone know how Fortinet achieve this functionality. Does anyone know the Technology behind this feature? Is this also possible using Linux and opensource tools? 

Best regards in advance 

Annex

[boneyard]

Annex you posted the same question twice, could you delete one of them?

as for your question i believe your friend misunderstood the goal of VDOMs and confuses them with high availibility (HA).

a VDOM is a virtual domain, you can configure multiple on ONE firewall (cluster) and as such realize something like multiple virtual firewalls. this technology is similar to VRFs in Cisco, not sure if this is available in open source tools, i would google for virtual routing domains or such.

HA is for Fortigate only possible with similar devices (so not 60 with 90). something like that is probably possible with open source in terms like clustering or if you just need it on IP level with something like VRRP.

with some googling you should be able to find enough.

[emnoc]

Also vdoms  are limited to a count of 10 per-unit, but any  chassis models of #s 3000 or bigger have vdom license to increase the  vdom count with most appliances.

VDOMs are like  VRF ( virtual router forwarder ) in the cisco-routers or  "Contexts" for the  cisco firewall appliances, or VR ( virtual Routers ) in Junos  , or VSYS ( virtual systems ) In Palo Alto or for the opensource linux world it's known as NETNS ( Network NameSapce ) which segments  router forwarder domains in the same fashion as cisco VRFs

BUT a VRF is not a  a VDOM nor 100% similar. A vdom can be transparent or routed/NAT or a mix of the two.

http://socpuppet.blogspot.com/2014/09/a-meshed-vdom-transparent-using-inter.html