Fortigate VDOMs and MPLS

[koltyn]

Hi everyone,

I am currently learning about VDOMs and have a hypothetical question. If you have a company with 10 locations, all connected with each other through MPLS, and only the headquarters has a Fortigate. Is there any benefit in making a separate VDOM for all 10 sites, and configure their VLANs on their own VDOM?

I am fairly new to Fortinet so a VDOM is new to me. Is there any reason to use VDOMs instead of just creating all the VLANs and policies in the default VDOM?

Is my understanding of a VDOM also correct, meaning is this the intended use of it or am I completely missing the point?

[knagaraju]

Hello koltyn,

In simple terms, a VDOM means dividing one physical FortiGate into multiple virtual FortiGate.
VDOM concept is similar to the concept of VLAN on a switch.
Coming to your requirement of connecting 10 branches to the same FortiGate (HUB).
If you configure one VDOM per branch then their policies, routing, and VLANs will be assigned to that specific VDOM. 
Except this, there are no other additional options.

For your requirement, one VDOM per branch can be configured. However by default on Fortigate 10VDOMs are supported without license.
If you want to configure more VDOMs then an additional license has to be purchased for VDOM.

Please let me know if you have any additional queries.

Regards
Nagaraju.

[saneeshpv_FTNT]

Hi,

VDOM is a feature that allows you to create multiple virtual instances of the FortiGate device, effectively partitioning a single physical FortiGate appliance into multiple logical firewalls to support Multi-tenancy. So idea here is, for example, you have a big FortiGate box and you want to use the same Physical Firewall for different departments or section of your network (Internal, DMZ or Perimeter Firewall), you can create VDOM for each and can segregate network Security policies and configuration and providing required isolation and compliance.

Regards,

[saneeshpv_FTNT]

Hi,

I missed to answer you actual question about benefit of having VDOM in your setup. 

I don't see any benefit of creating multiple VDOM for each branch as long you don't have a specific compliance requirement to do so. 

Best Regards

[Toshi_Esumi]

The most common use of VDOMs are separating tenants/customers, who should NOT be talking each others directly, also who may be using overlapping subnets like 192.168.1.0/24.

Toshi