Associating an NSX-T service profile with a VDOM

You can associate NSX-T service profiles with individual VDOMs of FortiGate instances to redirect traffic from one VDOM to another.

To associate an NSX-T service profile with a VDOM:

1. Create a service profile for each VDOM in the VMware NSX-T:
   1. Go to Security > Settings (Network Introspection Settings) > Service Profiles.
   2. Click ADD SERVICE PROFILE.
   3. In the Service Profile Name field, enter the desired name.
   4. From the Vendor Template dropdown list, select the desired template.
   5. Click SAVE.
   6. Repeat the process for other VDOMs as desired.
2. Create a service chain for each VDOM:
   1. Go to Security > Settings (Network Introspection Settings) > Service Chains.
   2. Click ADD CHAIN.
   3. In the Name field, enter the desired name.
   4. From the Service Segments dropdown list, select the desired service segment.
   5. In the Forward Path field, add the service profile that you created in step 1.
   6. Add other service profiles in sequence as needed.
   7. Enable Inverse Forward Path.
   8. Click SAVE.
3. Configure the NSX-T connector:
   1. In FortiManager in the same ADOM as the NSX-T connector, go to Policy & Objects > Object Configurations > Endpoint/Identity.
   2. Select the NSX-T connector, then click Configure.
   3. Select a service, then click Configure.
   4. Click Add to add a new service chain.
   5. From the Device dropdown list, select the device to which to apply the service chain.
   6. From the Index and Reverse Index dropdown lists, select the newly created service profile.
   7. From the Chain ID and VDOM dropdown lists, select the chain ID and VDOM to apply the service chain to.
   8. Click OK.

4. Import the device settings to the FortiGate:

   1. In FortiManager, go to Device Manager.
   2. Select the FortiGate to apply the newly created policy to.
   3. Run the install wizard to import the changed device settings.
5. In NSX-T Manager, go to Security > Network Introspection (E-W).
6. Click ADD POLICY.
7. Select the chain that corresponds to the VDOM where traffic will be redirected.
8. In the policy options menu, click Add Rule to add the new rule to the policy.

   NSX-T allows you to create rules that apply to the same security group under different policies. See Add Redirection rules for E-W traffic. This configuration is not recommended while using VDOMs, as it may lead to unintended behavior.

   See East-West Network Security - Chaining Third-party Services for information on configuring redirection rules.

9. Click Publish to apply changes.