FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
nithincs
Staff
Staff

Description


This article provides steps to enable the usage of multiple VDOMs.

Solution


Below commands are used to enable multiple VDOMs in different FortiOS versions.

In version 5.6 and 6.0.

# config sys global
    set vdom-admin enable
end

In versions 6.2, 6.4 and 7.0 fortiOS, there are two VDOM modes.

'split-vdom': split-task VDOM mode simplifies deployments that require only one management VDOM and one traffic VDOM.
The management VDOM is used to manage the FortiGate, and cannot be used to process traffic.

The traffic VDOM provides separate security policies, and is used to process all network traffic.

'multi-vdom': multiple, completely separate VDOMs are created.
Any VDOM can be the management VDOM, as long as it has internet access.

There are no 'inter-VDOM' links, and each VDOM is independently managed.

To enable 'multiple vdom'.

# config sys global
    set vdom-mode multi-vdom   
end

To enable 'split-vdom'.

# config sys global
    set vdom-mode split-vdom
end

Additional to the above, starting from version 6.4 onwards, you can also enable the following to prevent accidentally creating VDOMs in the CLI:

config system global
set edit-vdom-prompt enable
end

This setting is disabled by default. Once enabled, when an administrator creates a new VDOM, the FortiGate displays a prompt to confirm before the VDOM is created.

(global) # config vdom
edit vdomtest1
The input VDOM name doesn't exist.
Do you want to create a new VDOM?
Press 'y' to continue, or press 'n' to cancel. (y/n)y

 

NOTE.

FortiProxy product (any version) does not support multi-vdom configuration in any version.

 

Related link:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/109991