multiple vdoms, including transparent mode, what is best design?

[Ralph1973]

Hello, We have to configure a network for one of our customers. They have 4 vlans for internal use and 2 dmz' s where they want to put their servers in. The customer wants to use additional firewalls which we have to make virtual, so we configure vdoms. They want the vlans and dmz' s in their unique vdom and then route the traffic to a 3rd firewall (vdom) to reach the internet. This 3rd vdom needs to do all the UTM stuff. Question is: what will be the best approach? I have added a simple drawing with the vdoms depicted as physical units. There is one internet feed, how to make this one available for all vdoms? Thanks for any help, kind regards, Ralph

[PM]

Ralph, I' ve attached a diagram showing a logical design I' ve used at a couple of deployments. So far the design has worked well for me. Couple of things to keep in mind regarding the diagram and design : - VDOM Links has been used to link the VDOMs to the root VDOM. No other linking between VDOMs were done, but can be. - Every VDOM (other than root) has a default static route 0.0.0.0 with destination interface set as the VDOM Link interface in the VDOM, ie for LANVDOM the static route 0.0.0.0 points to the LAN-VL0 interface. - Inter VLAN traffic forwarding is disabled and f/w policies allow only specific comms between VLANs - F/w policies are defined between the VLAN interfaces and the VDOM Link interfaces to allow inbound and outbound traffic into and out of the VDOM. - In the root VDOM the default static route 0.0.0.0 destination interface is External1 (Zone interface). - Static routes has been defined for all internal IP ranges to their respective VDOM Link interfaces in the root VDOM, ie 192.168.1.0/24 routes to the LAN-VL1 interface. - Outbound (internet) policies has NAT enabled in the root VDOM only. - Other f/w policies has been defined to control inter VDOM traffic (all routed through the root VDOM). - External2 zone interface was used for policy based routing, ie Execs SSID was routed out through the External2 interface.... - UTM filtering was applied mostly in the root VDOM. Depends on what you have on the network and where the most appropriate place is to filter, ie To recap, keep routing in mind and which interfaces the traffic traverses. Match the flows with routes and f/w policies. This is not a reference architecture, just an example of what I' ve deployed. There are many ways to skin four legged creatures.... Hope it helps. Regards Paul

[Ralph1973]

Hello Paul, I will send you a virtual bottle of beer :) This was really helpfull, since there is no real documentation about configuring it this way. With regards to your drawing, do I understand it right that: lanvdom0 has gateway lan-vl0 root vdom has a route to each vlan , e.g. vlan 11 via Lan-vl1 the vlans in the vdom e.g. officelan vlan 11 in lanvdom has a default route to lan-vl0? The policy from vlan 11 to reach the internet is from vlan 11 to lan -vl0 and then Nat enabled? the last two are not entirely clear for me With kind regards, Ralph

[emnoc]

If this is for one customer & only one customer, than you are doing a lot or work and vdoms is probably not the right solution. Crafting multi-vdoms and then mix' ing interface in one vdom with access to services in another , tells me this not the norm and you would be better off with no VDOM deployed and proper firewall architect imho. btw nice looking diagram :)

[PM]

If the diagram is the only thing that is useful, so be it. :P This customer in particular has 4 IT companies under the same roof using shared, dedicated infrastructure, hosted public and private services etc . The initial design had 2 VDOMs but quickly became difficult to maintain with all the policies as each company had specific (read paranoid, full of ...., etc) requirements. So broke the whole thing up into logical groupings. You can print out the diagram, take a pencil and draw the traffic flow and then configure the routes and policies to a picture ;) Believe it or not, the diagram is a simplified version of the real configuration :) Lots of IPSec tunnels, a VDOM in transparent mode and other stuff removed, just to show the concept... - lanvdom0 has gateway lan-vl0 >> VDOM LANVDOM' s default route points to lan-vl0 - root vdom has a route to each vlan , e.g. vlan 11 via Lan-vl1 >> Yes, same goes for the other VDOMs, routes to the VLAN IP range points to the appropriate VLAN interface - the vlans in the vdom e.g. officelan vlan 11 in lanvdom has a default route to lan-vl0? >> The default route is configured in the VDOM routing table as : LANVDOM static routes : 0.0.0.0 -> lan-vl0 192.168.1.0/24 -> OfficeLAN 10.11.51.0/24 -> VMWareLAN1 etc. Same pattern in each VDOM, including the root VDOM. - The policy from vlan 11 to reach the internet is from vlan 11 to lan -vl0 and then Nat enabled? >> You will have two policies for that use case : 1) LANVDOM: From 192.168.1.0/24 (Src int OfficeLAN) to Any (Dest int LAN-VL0), service HTTP, schedule always, NO NAT 2) root VDOM: From 192.168.1.0/24 (Src int LAN-VL1) to Any (Dest int External1), service HTTP, schedule always, UTM enabled, NAT ENabled (using specific interface IP 41.x.x.19 for example) Less specific policies were used in the LAN/Wifi <-> root comms, and very very specific policies in the DMZ <-> root, other VDOMs and IPSec tunnel comms. In this case, a multitude of requirements drove the design.