In the past, virtual domains (VDOMs) were separate from each other and there was no internal communication. Any communication between VDOMs involved traffic leaving on a physical interface belonging to one VDOM and re-entering the FortiGate unit on another physical interface belonging to another VDOM to be inspected by firewall policies in both directions.
Inter-VDOM routing changes this. With VDOM links, VDOMs can communicate internally without using additional physical interfaces.
Inter-VDOM routing is the communication between VDOMs. VDOM links are virtual interfaces that connect VDOMs. A VDOM link contains a pair of interfaces, each one connected to a VDOM and forming either end of the inter-VDOM connection.
When VDOMs are configured on your FortiGate unit, configuring inter-VDOM routing and VDOM-links is very much like creating a VLAN interface. VDOM-links are managed through the web-based manager or CLI. In the web-based manager, VDOM link interfaces are managed in the network interface list.
VDOM link does not support traffic offload. If you want to use traffic offload, use NPU-VDOM-LINK.
To configure a VDOM link in the GUI:
- Go to Network > Interfaces.
- Click Create New > VDOM Link.
- Configure the fields including the Name, Virtual Domain, IP information, access levels, and other fields.
To configure a VDOM link in the CLI:
config system vdom-link edit "<vdom-link-name>" next end config system interface edit "<vdom-link-name0>" set vdom "<VDOM Name>" set type vdom-link next end config system interface edit "<vdom-link-name1>" set vdom "<VDOM Name>" set type vdom-link next end
To delete a VDOM link in the GUI:
- Go to Network > Interfaces.
- Select a VDOM Link and click Delete.
To delete a VDOM link in the CLI:
config system vdom-link delete <VDOM-LINK-Name> end
Sample configuration: Inter-VDOM routing
This example shows how to configure a FortiGate unit to use inter-VDOM routing.
Two departments of a company, Accounting and Sales, are connected to one FortiGate. The company uses a single ISP to connect to the Internet.
This example includes the following general steps. We recommend following the steps in the order below.
Create the VDOMs
To enable VDOMs and create the Sales and Accounting VDOMs:
config system global set vdom-mode multi-vdom end config system vdom edit Accounting next edit Sales next end
Configure the physical interfaces
Next, configure the physical interfaces. This example uses three interfaces on the FortiGate unit: port2 (internal), port3 (DMZ), and port1 (external). Port2 and port3 interfaces each have a department’s network connected. Port1 is for all traffic to and from the Internet and uses DHCP to configure its IP address, which is common with many ISPs.
config global config system interface edit port2 set alias AccountingLocal set vdom Accounting set mode static set ip 126.96.36.199 255.255.0.0 set allowaccess https ping ssh set description "The accounting dept internal interface" next edit port3 set alias SalesLocal set vdom Sales set mode static set ip 192.168.1.1 255.255.0.0 set allowaccess https ping ssh set description "The sales dept. internal interface" next edit port1 set alias ManagementExternal set vdom root set mode DHCP set distance 5 set gwdetect enable set dns-server-override enable set allowaccess https ssh snmp set description “The systemwide management interface.” end end
Configure the VDOM links
To complete the connection between each VDOM and the management VDOM, add the two VDOM links. One pair is the Accounting – management link and the other is the Sales – management link.
When configuring inter-VDOM links, you do not have to assign IP addresses to the links unless you are using advanced features such as dynamic routing that require them. Not assigning IP addresses results in faster configuration and more available IP addresses on your networks.
To configure the Accounting and management VDOM link:
config global config system vdom-link edit AccountVlnk next end config system interface edit AccountVlnk0 set vdom Accounting set ip 188.8.131.52 255.255.255.0 set allowaccess https ping ssh set description “Accounting side of the VDOM link“ next edit AccountVlnk1 set vdom root set ip 184.108.40.206 255.255.255.0 set allowaccess https ping ssh set description “Management side of the VDOM link“ end end
To configure the Sales and management VDOM link:
config global config system vdom-link edit SalesVlnk end config system interface edit SalesVlnk0 set vdom Accounting set ip 220.127.116.11 255.255.255.0 set allowaccess https ping ssh set description "Sales side of the VDOM link" next edit SalesVlnk1 set vdom root set ip 18.104.22.168 255.255.255.0 set allowaccess https ping ssh set description "Management side of the VDOM link" end end
Configure the firewall and Security Profile
With the VDOMs, physical interfaces, and VDOM links configured, the firewall must now be configured to allow the proper traffic. Firewalls are configured per-VDOM, and firewall objects and routes must be created for each VDOM separately.
To configure the firewall policies from AccountingLocal to Internet:
config vdom edit Accounting config firewall policy edit 1 set name "Accounting-Local-to-Management" set srcintf port2 set dstintf AccountVlnk set srcaddr all set dstaddr all set action accept set schedule always set service ALL set nat enable end end config vdom edit root config firewall policy edit 2 set name "Accounting-VDOM-to-Internet" set srcintf AccountVlnk set dstintf port1 set srcaddr all set dstaddr all set action accept set schedule always set service ALL set nat enable end end
To configure the firewall policies from SalesLocal to the Internet:
config vdom edit root config firewall policy edit 6 set name "Sales-local-to-Management" set srcintf port2 set srcaddr all set dstintf SalesVlnk set dstaddr all set schedule always set service ALL set action accept set logtraffic enable end end config vdom edit Sales config firewall policy edit 7 set name "Sales-VDOM-to-Internet" set srcintf SalesVlnk set srcaddr SalesManagement set dstintf external set dstaddr all set schedule always set service OfficeServices set action accept set logtraffic enable end end
Test the configuration
When the inter-VDOM routing has been configured, test the configuration to confirm proper operation.
Testing connectivity ensures that physical networking connections, FortiGate unit interface configurations, and firewall policies are properly configured.
The easiest way to test connectivity is to use the
traceroute command to confirm the connectivity of different routes on the network.
Test both from AccountingLocal to Internet and from SalesLocal to Internet.