VDOM overview
The following sections provide conceptual information on VDOMs:
The following sections provide information on methods of VDOM configuration:
Multi-VDOM mode
In multi-VDOM mode, the FortiGate can have multiple VDOMs that function as independent units. When multi-VDOM mode is first enabled, all VDOM configurations will move to the root VDOM by default. The root VDOM cannot be deleted, and remains in the configuration even if it is not processing any traffic. New VDOMs can be created, up to the VDOM limit allowable on your device.
Global settings
Global settings are configured outside of a VDOM. They effect the entire FortiGate, and include settings such as interfaces, firmware, DNS, some logging and sandboxing options, and so on. Global settings should only be changed by top level administrators.
Global and per-VDOM resources
Global and per-VDOM resources can be configured when the FortiGate is in multi-VDOM mode. Global resources apply to resources that are shared by the whole FortiGate, while per-VDOM resources are specific to each VDOM.
By default, all per-VDOM resource settings are set to have no limits. This means that any single VDOM can use all of the FortiGate device's resources. This could deprive other VDOMs of the resources that they require, to the point that could be unable to function. We recommend setting maximum values on the resources that are vital to you.
Management VDOM
The management VDOM refers to the specific role that must be designated to one of the VDOMs. By default, the root VDOM is the management VDOM, and management-related services such as FortiGuard updates and other local out (self-originating) traffic such as logs to remote servers originate from the management VDOM. The management VDOM cannot be deleted. See Management VDOM for configuration details.
VDOM types
When a FortiGate is in multi-VDOM mode, a VDOM can be configured as an Admin, Traffic, or LAN extension type VDOM.
When the VDOM type is set to Admin, the VDOM is used to administer and manage the FortiGate. Usually, the Admin VDOM resides in a management network which is only accessible by administrators. Global and VDOM administrators can log in to the FortiGate using SSH, HTTPS, and so on but traffic cannot pass through this Admin VDOM. A FortiGate does not need to have an Admin VDOM and, at most, there can only be one Admin VDOM per FortiGate.
When VDOM type is set to Traffic, the VDOM can pass traffic like a regular firewall. Most VDOMs will be Traffic type VDOMs. Network interfaces on a Traffic VDOM can also enable SSH, HTTPS, and so on for administrative and management purposes.
In general, an Admin VDOM has a subset of a Traffic VDOM’s capabilities. See Configure an administrative VDOM type for configuration details.
A LAN extension mode VDOM allows a remote FortiGate to provide remote connectivity to a local FortiGate over a backhaul connection. It can only be configured in the CLI. See FortiGate LAN extension for details.
|
FortiGate-VM supports having at least two VDOMs; one that supports an administrative VDOM and another that supports a traffic VDOM. |
Administrator roles and views
When a FortiGate has been configured in multi-VDOM mode, the device can be managed by global administrators and per-VDOM administrators. Each type of administrator will have a different view of the GUI in multi-VDOM mode which corresponds to their role.
Global administrators
Global administrators have complete visibility and access because the scope of their role is to manage the entire physical FortiGate device. An example of a global administrator is an administrator working for a managed security services provider (MSSP) providing the FortiGate as a multi-tenant environment to its clients.
When global administrators log into the GUI, from the VDOM: Global view they will see all pages for global settings shared between VDOMs, and VDOM-specific settings.
To create a global administrator that has access to all VDOMs and access to global settings, it must be created at the global level and must use the super_admin administrator profile.
See Administrator profiles and Local authentication for configuration details.
VDOM administrators
VDOM administrators will be unable to view global settings or VDOMs not assigned to them because the scope of their role is restricted to managing specific VDOMs only. An example of a VDOM administrator is the administrator working for a company which is a client, or tenant, of an MSSP’s multi-tenant FortiGate.
When VDOM administrators log into the GUI, from the VDOM:<VDOM> view they will see pages for settings specific to the VDOM they have been configured to administer such as interfaces, routes, firewall policies, and security profiles.
See Create per-VDOM administrators for configuration details.
Inter-VDOM routing
VDOM links are virtual interfaces that allow VDOMs to communicate internally without using additional physical interfaces. A VDOM link contains a pair of interfaces, each one connected to a VDOM to form each end of the inter-VDOM connection. Inter-VDOM routing can be configured in order to communicate between one VDOM to another.
When VDOMs are configured on your FortiGate unit, configuring inter-VDOM routing and VDOM links is similar to creating a VLAN interface. VDOM links can be managed in either the CLI or in the network interface list in the GUI.
See Inter-VDOM routing configuration example: Internet access for more information.
Topologies
These are the main configuration types in multi-VDOM mode:
Independent VDOMs
Multiple, completely separate VDOMs are created. Any VDOM can be the management VDOM, as long as it has Internet access to connect to FortiGuard services and other management resources. There are no inter-VDOM links, and each VDOM is independently managed.
Internet access VDOM
In the Internet access VDOM configuration, Internet access is provided primarily by a single VDOM; for example, the management VDOM (depicted as root VDOM in the preceding diagram). Each tenant connects to the management VDOM via an inter-VDOM link. The management VDOM has complete control over Internet access, including the types of traffic that are allowed in both directions. This can improve security, as there is only one point of ingress and egress.
There is no communication between the other VDOMs.
Meshed VDOMs
VDOMs can communicate with inter-VDOM links. In full-mesh configurations, all the VDOMs are interconnected. In partial-mesh configurations, only some of the VDOMs are interconnected.
In this configuration, inter-vdom links between tenants are created by the global administrator, but each tenant controls the firewall policies to allow access to other tenants.
See Inter-VDOM routing and Inter-VDOM routing configuration example: Internet access for configuration details.
Administrative VDOM on a management network
The administrative VDOM type can be used to limit administrative access to the FortiGate using SSH, HTTPS and so on to administrators working from a management network. Administrators may be limited to management settings or may have global privileges to access other VDOMs. The user or tenant network (depicted as Network A in the diagram) uses a traffic type VDOM, which allows traffic to pass through it like a regular firewall and allows configuration of firewall-related settings. This configuration can improve security if the management network is a closed network and administrative access is not enabled on any interfaces on the traffic VDOM.
Best practices
VDOMs can provide separate firewall policies and, in NAT mode, completely separate configurations for routing and VPN services for each connected network or organization. This section provides a list of best practices for configuring VDOMs.
Per-VDOM resource setting
All per-VDOM resource settings are set to no limit by default. To ensure proper functionality of all VDOMs, it is recommended that you set some maximum values for the most vital resources. See Global and per-VDOM resources for configuration details.
Virtual domains in NAT mode
Once the virtual domains have been enabled and one or more VDOMs have been created, they must be configured. The following steps provide a general overview of the configuration process.
To configure VDOMs:
-
Change the management virtual domain.
-
Configure FortiGate interfaces for your VDOMs in NAT mode.
-
Configure VDOM routing.
-
Configure security policies for VDOMs in NAT mode.
-
Configure UTM profiles for VDOMs in NAT mode.
-
Test the configuration.
|
|
While you may not require all of the steps for your network topology, it is recommended that you perform them in the order given. |
See General configurations for configuration details.
Virtual clustering
Virtual clustering is an extension of FGCP HA that provides failover protection between two instances of one or more VDOMs operating on two FortiGates that are in a virtual cluster. A standard virtual cluster consists of FortiGates that are operating in active-passive HA mode with multiple VDOMs enabled. See HA virtual cluster setup for more details.
Typically, virtual clustering is configured with override enabled and uses device priorities to distribute traffic between the primary and secondary FortiGates.
If you decide to disable override for clustering, as a result of persistent renegotiating, you should disable it for both cluster units.