Tag Archives: fortinet Virtual Domains in NAT/Route mode

Virtual Domains in NAT/Route mode

Virtual Domains in NAT/Route mode

By default, a Virtual Domain (VDOM) uses NAT/Route mode. In this mode, the VDOM is installed as a gateway or router between two networks. In most cases, it is used between a private network and the Internet. This allows the VDOM to hide the IP addresses of the private network using network address translation (NAT).

Each VDOM on a FortiGate can be configured for NAT/Route mode or Transparent mode, regardless of the operation mode of other VDOMs on the FortiGate. For more information about Transparent mode, see “Virtual Domains in Transparent mode” on page 2621.

 

This chapter contains the following sections:

  • Using a VDOM in NAT/Route mode
  • Example configuration: VDOM in NAT/Route mode

 

Using a VDOM in NAT/Route mode

Once you have enabled virtual domains and created one or more VDOMs, you need to configure them. Configuring VDOMs on your FortiGate unit includes tasks such as the ones listed here; while you may not require all for your network topology, it is recommended that you perform them in the order given:

  • Changing the management virtual domain
  • Configuring interfaces in a NAT/Route VDOM
  • Configuring VDOM routing
  • Configuring security policies for NAT/Route VDOMs
  • Configuring security profiles for NAT/Route VDOMs

 

Changing the management virtual domain

The management virtual domain is the virtual domain where all the management traffic for the FortiGate unit originates. This management traffic needs access to remote servers, such as FortiGuard services and NTP, to perform its duties. It needs access to the Internet to send and receive this traffic.

 

Management traffic includes, but is not limited to

  • DNS lookups
  • logging to FortiAnalyzer or syslog
  • FortiGuard service
  • sending alert emails
  • Network time protocol traffic (NTP)
  • Sending SNMP traps
  • Quarantining suspicious files and email.

By default the management VDOM is the root domain. When other VDOMs are configured on your FortiGate unit, management traffic can be moved to one of these other VDOMs.

Reasons to move the management VDOM include selecting a non-root VDOM to be your administration VDOM, or the root VDOM not having an interface with a connection to the Internet.

You cannot change the management VDOM if any administrators are using RADIUS authentication.

The following procedure will change the management VDOM from the default root to a VDOM named mgmt_ vdom. It is assumed that mgmt_vdom has already been created and has an interface that can access the Internet.

 

To change the management VDOM – web-based manager:

1. Select Global > System > VDOM.

2. Select the checkbox next to the required VDOM.

3. Select Switch Management.

The current management VDOM is shown in square brackets, “[root]” for example.

 

To change the management VDOM – CLI:

config global

config system global

set management-vdom mgmt_vdom end

Management traffic will now originate from mgmt_vdom.

 

Configuring interfaces in a NAT/Route VDOM

A VDOM must contain at least two interfaces to be useful. These can be physical interfaces or VLAN interfaces. By default, all physical interfaces are in the root VDOM. When you create a new VLAN, it is in the root VDOM by default.

When there are VDOMs on the FortiGate unit in both NAT and Transparent operation modes, some interface fields will be displayed as “-” on Network > Interfaces. Only someone with a super_admin account can view all the VDOMs.

When moving an interface to a different VDOM, firewall IP pools and virtual IPs for this interface are deleted. You should manually delete any routes that refer to this inter- face. Once the interface has been moved to the new VDOM, you can add these ser- vices to the interface again.

When configuring VDOMs on FortiGate units with accelerated interfaces you must assign both interfaces in the pair to the same VDOM for those interfaces to retain their acceleration. Otherwise they will become normal interfaces.

 

This section includes the following topics:

  • Adding a VLAN to a NAT/Route VDOM
  • Moving an interface to a VDOM
  • Deleting an interface
  • Adding a zone to a VDOM

 

Adding a VLAN to a NAT/Route VDOM

The following example shows one way that multiple companies can maintain their security when they are using one FortiGate unit with VLANs that share interfaces on the unit.

This procedure will add a VLAN interface called client1-v100 with a VLAN ID of 100 to an existing VDOM called client1 using the physical interface called port2.

The physical interface does not need to belong to the VDOM that the VLAN belongs to.

 

To add a VLAN subinterface to a VDOM – web-based manager:

  1. 1. Go to Global > Network > Interfaces.
  2. 2. Select Create New.
  3. 3. Enter the following information and select OK:

Name                                           client1-v100

Interface                                     port2

VLAN ID                                      100

Virtual Domain                          Client1

Addressing mode                     Manual

IP/Netmask                                 172.20.120.110/255.255.255.0

Administrative Access             HTTPS, SSH

You will see an expand arrow added to the port2 interface. When the arrow is expanded, the interface shows the client1-v100 VLAN subinterface.

 

To add a VLAN subinterface to a VDOM – CLI:

config global

config system interface edit client1-v100

set type vlan set vlanid 100 set vdom Client1

set interface port2

set ip 172.20.120.110 255.255.255.0 set allowaccess https ssh

end

 

Moving an interface to a VDOM

Interfaces belong to the root VDOM by default. Moving an interface is the same procedure no matter if its moving from the root VDOM or a any other VDOM.

If you have an accelerated pair of physical interfaces both interfaces must be in the same VDOM or you will lose their acceleration.

The following procedure will move the port3 interface to the Client2 VDOM. This is a common action when configuring a VDOM. It is assumed that the Client2 VDOM has already been created. It is also assumed that your FortiGate unit has a port3 interface. If you are using a different model, your physical interfaces may not be named port2, external or port3.

 

To move an existing interface to a different VDOM – web-based manager:

1. Go to Global > Network > Interfaces.

2. Select Edit for the port3 interface.

3. Select Client2 as the new Virtual Domain.

4. Select OK.

 

To move an existing interface to a different VDOM – CLI:

config global

config system interface edit port3

set vdom Client2 end

 

Deleting an interface

Before you can delete a virtual interface, or move an interface from one VDOM to another, all references to that interface must be removed. For a list of objects that can refer to an interface see Virtual Domains Overview.

The easiest way to be sure an interface can be deleted is when the Delete icon is no longer greyed out. If it remains greyed out when an interface is selected, that interface still has objects referring to it, or it is a physical interface that cannot be deleted.

 

To delete a virtual interface – web-based manager:

1. Ensure all objects referring to this interface have been removed.

2. Select Global > Network > Interfaces.

3. Select the interface to delete.

4. Select the delete icon.

 

Adding a zone to a VDOM

Grouping interfaces and VLAN subinterfaces into zones simplifies policy creation. You can configure policies for connections to and from a zone, but not between interfaces in a zone.

Zones are VDOM-specific. A zone cannot be moved to a different VDOM. Any interfaces in a zone cannot be used in another zone. To move a zone to a new VDOM requires deleting the current zone and re-creating a zone in the new VDOM.

The following procedure will create a zone called accounting in the client2 VDOM. It will not allow intra- zone traffic, and both port3 and port2 interfaces belong to this zone. This is a method of grouping and isolating traffic over particular interfaces—it is useful for added security and control within a larger network.

 

To add a zone to a VDOM – web-based manager:

1. In Virtual Domains, select the client2 VDOM.

2. Go to Network > Interfaces.

3. Select Create New > Zone.

4. Enter the following information and select OK:

Zone Name                                 accounting

Block intra-zone traffic             Select

Interface Members                    port3, port2

To add a zone to a VDOM – CLI:

config vdom

edit client2

config system zone edit accounting

set interface port3 port2 set intrazone deny

end

end

 

Configuring VDOM routing

Routing is VDOM-specific. Each VDOM should have a default static route configured as a minimum. Within a VDOM, routing is the same as routing on your FortiGate unit without VDOMs enabled.

When configuring dynamic routing on a VDOM, other VDOMs on the FortiGate unit can be neighbors. The following topics give a brief introduction to the routing protocols, and show specific examples of how to configure dynamic routing for VDOMs. Figures are included to show the FortiGate unit configuration after the successful completion of the routing example.

 

Default static route for a VDOM

The routing you define applies only to network traffic entering non-ssl interfaces belonging to this VDOM. Set the administrative distance high enough, typically 20, so that automatically configured routes will be preferred to the default.

In the following procedure, it is assumed that a VDOM called “Client2” exists. The procedure will create a default static route for this VDOM. The route has a destination IP of 0.0.0.0, on the port3 interface. It has a gateway of 10.10.10.1, and an administrative distance of 20.

The values used in this procedure are very standard, and this procedure should be part of configuring all VDOMs.

 

To add a default static route for a VDOM – web-based manager:

1. In Virtual Domains, select the client2 VDOM.

2. Go to Network > Static Routes.

3. Select Create New.

4. Enter the following information and select OK:

Destination IP/Mask                 0.0.0.0/0.0.0.0

Device                                         port2

Gateway                                     10.10.10.1

Distance                                     20

 

To add a default static route for a VDOM – CLI:

config vdom

edit client2

config router static edit 4

set device port2

set dst 0.0.0.0 0.0.0.0 set gateway 10.10.10.1 set distance 20

end

end

 

Dynamic Routing in VDOMs

Dynamic routing is VDOM-specific, like all other routing. Dynamic routing configuration is the same with VDOMs as with your FortiGate unit without VDOMs enabled, once you are at the routing menu. If you have multiple VDOMs configured, the dynamic routing configuration between them can become quite complex.

VDOMs provide some interesting changes to dynamic routing. Each VDOM can be a neighbor to the other VDOMs. This is useful in simulating a dynamic routing area or AS or network using only your FortiGate unit.

You can separate different types of routing to different VDOMs if required. This allows for easier troubleshooting. This is very useful if your FortiGate unit is on the border of a number of different routing domains.

For more information on dynamic routing in FortiOS, see the Advanced Routing handbook.

Inter-VDOM links must have IP addresses assigned to them if they are part of a dynamic routing configuration. Inter-VDOM links may or may not have IP addresses assigned to them. Without IP addresses, you need to be careful how you configure routing. While the default static route can be assigned an address of 0.0.0.0 and rely instead on the interface, dynamic routing almost always requires an IP address.

 

RIP

The RIP dynamic routing protocol uses hop count to determine the best route, with a hop count of 1 being directly attached to the interface and a hop count of 16 being unreachable. For example if two VDOMs on the same FortiGate unit are RIP neighbors, they have a hop count of 1.

 

OSPF

OSPF communicates the status of its network links to adjacent neighbor routers instead of the complete routing table. When compared to RIP, OSPF is more suitable for large networks, it is not limited by hop count, and is more complex to configure. For smaller OSPF configurations its easiest to just use the backbone area, instead of multiple areas.

 

BGP

BGP is an Internet gateway protocol (IGP) used to connect autonomous systems (ASes) and is used by Internet service providers (ISPs). BGP stores the full path, or path vector, to a destination and its attributes which aid in proper routing.

 

Configuring security policies for NAT/Route VDOMs

Security policies are VDOM-specific. This means that all firewall settings for a VDOM, such as firewall addresses and security policies, are configured within the VDOM.

In VDOMs, all firewall related objects are configured per-VDOM including addresses, service groups, security profiles, schedules, traffic shaping, and so on. If you want firewall addresses, you will have to create them on each VDOM separately. If you have many addresses, and VDOMs this can be tedious and time consuming. Consider using a FortiManager unit to manage your VDOM configuration — it can get firewall objects from a configured VDOM or FortiGate unit, and push those objects to many other VDOMs or FortiGate units. See the FortiManager Administration Guide.

You can customize the Policy display by including some or all columns, and cus- tomize the column order onscreen. Due to this feature, security policy screenshots may not appear the same as on your screen.

 

Configuring a security policy for a VDOM

Your security policies can involve only the interfaces, zones, and firewall addresses that are part of the current VDOM, and they are only visible when you are viewing the current VDOM. The security policies of this VDOM filter the network traffic on the interfaces and VLAN subinterfaces in this VDOM.

A firewall service group can be configured to group multiple services into one service group. When a descriptive name is used, service groups make it easier for an administrator to quickly determine what services are allowed by a security policy.

In the following procedure, it is assumed that a VDOM called Client2 exists. The procedure will configure an outgoing security policy. The security policy will allow all HTTPS, SSH, and DNS traffic for the SalesLocal address group on VLAN_200 going to all addresses on port3. This traffic will be scanned and logged.

 

To configure a security policy for a VDOM – web-based manager:

1. In Virtual Domains, select the client2 VDOM.

2. Go to Policy & Objects > IPv4 Policy.

3. Select Create New.

4. Enter the following information and select OK:

Name                                        Client2-outgoing

Incoming Interface                   VLAN_200

Outgoing Interface                   port3

Source Address                        SalesLocal

Destination Address                 any

Schedule                                    always

Service                                       HTTPS, SSH, DNS

Action                                         ACCEPT

Log Allowed Traffic                  enable

 

To configure a security policy for a VDOM – CLI:

config vdom

edit Client2

config firewall policy edit 12

set srcintf VLAN_200 set srcaddr SalesLocal set dstintf port3(dmz) set dstaddr any

set schedule always set service HTTPS SSH set action accept

set status enable

set logtraffic enable end

end

 

Configuring security profiles for NAT/Route VDOMs

In NAT/Route VDOMs, security profiles are exactly like regular FortiGate unit operation with one exception. In VDOMs, there are no default security profiles.

If you want security profiles in VDOMs, you must create them yourself. If you have many security profiles to create in each VDOM, you should consider using a FortiManager unit. It can get existing profiles from a VDOM or FortiGate unit, and push those profiles down to multiple other VDOMs or FortiGate units. See the FortiManager Administration Guide.

When VDOMs are enabled, you only need one FortiGuard license for the physical unit, and download FortiGuard updates once for the physical unit. This can result in a large time and money savings over multiple physical units if you have many VDOMs.

 

Configuring VPNs for a VDOM

Virtual Private Networking (VPN) settings are VDOM-specific, and must be configured within each VDOM. Configurations for IPsec Tunnel, IPsec Interface, PPTP and SSL are VDOM-specific. However, certificates are shared by all VDOMs and are added and configured globally to the FortiGate unit.

 

Example configuration: VDOM in NAT/Route mode

Company A and Company B each have their own internal networks and their own ISPs. They share a FortiGate unit that is configured with two separate VDOMs, with each VDOM running in NAT/Route mode enabling separate configuration of network protection profiles. Each ISP is connected to a different interface on the FortiGate unit.

 

This network example was chosen to illustrate one of the most typical VDOM configurations. This example has the following sections:

  • Network topology and assumptions
  • General configuration steps
  • Creating the VDOMs
  • Configuring the FortiGate interfaces
  • Configuring the vdomA VDOM
  • Configuring the vdomB VDOM
  • Testing the configuration

Network topology and assumptions

Both companies have their own ISPs and their own internal interface, external interface, and VDOM on the FortiGate unit.

For easier configuration, the following IP addressing is used:

  • all IP addresses on the FortiGate unit end in “.2” such as 10.11.101.2.
  • all IP addresses for ISPs end in “.7”, such as 172.20.201.7.
  • all internal networks are 10.*.*.* networks, and sample internal addresses end in “.55”.

The IP address matrix for this example is as follows.

Address Company A Company B
 

ISP

 

172.20.201.7

 

192.168.201.7

 

Internal network

 

10.11.101.0

 

10.012.101.0

 

FortiGate / VDOM

 

172.20.201.2 (port1)

 

10.11.101.2 (port4)

 

192.168.201.2 (port3)

 

10.012.101.2 (port2)

The Company A internal network is on the 10.11.101.0/255.255.255.0 subnet. The Company B internal network is on the 10.12.101.0/255.255.255.0 subnet.

There are no switches or routers required for this configuration. There are no VLANs in this network topology.

The interfaces used in this example are port1 through port4. Different FortiGate models may have different interface labels. port1 and port3 are used as external interfaces. port2 and port4 are internal interfaces.

The administrator is a super_admin account. If you are a using a non-super_admin account, refer to “Global and per-VDOM settings” to see which parts a non-super_admin account can also configure.

When configuring security policies in the CLI always choose a policy number that is higher than any existing policy numbers, select services before profile-status, and profile-status before profile. If these commands are not entered in that order, they may not be available to enter.

 

General configuration steps

For best results in this configuration, follow the procedures in the order given. Also, note that if you perform any additional actions between procedures, your configuration may have different results.

1. Creating the VDOMs

2. Configuring the FortiGate interfaces

3. Configuring the vdomA VDOM, and Configuring the vdomB VDOM

4. Testing the configuration

 

Creating the VDOMs

In this example, two new VDOMs are created — vdomA for Company A and vdomB for Company B. These VDOMs will keep the traffic for these two companies separate while enabling each company to access its own ISP.

 

To create two VDOMs – web-based manager:

1. Log in with a super_admin account.

2. Go to Global > System > VDOM, and select Create New.

3. Enter vdomA and select OK.

4. Select OK again to return to the VDOM list.

5. Select Create New.

6. Enter vdomB and select OK.

 

To create two VDOMs – CLI:

config vdom edit vdomA next

edit vdomB

end

 

Configuring the FortiGate interfaces

This section configures the interfaces that connect to the companies’ internal networks, and to the companies’ ISPs.

All interfaces on the FortiGate unit will be configured with an IP address ending in “.2” such as 10.11.101.2. This will simplify network administration both for the companies, and for the FortiGate unit global administrator. Also the internal addresses for each company differ in the second octet of their IP address – Company A is 10.11.*, and Company B is 10.12.*.

This section includes the following topics:

  • Configuring the vdomA interfaces
  • Configuring the vdomB interfaces

If you cannot change the VDOM of an network interface it is because something is referring to that interface that needs to be deleted. Once all the references are deleted the interface will be available to switch to a different VDOM. For example a common reference to the external interface is the default static route entry. See Example con- figuration: VDOM in NAT/Route mode.

 

Configuring the vdomA interfaces

The vdomA VDOM includes two FortiGate unit interfaces: port1 and external.

The port4 interface connects the Company A internal network to the FortiGate unit, and shares the internal network subnet of 10.11.101.0/255.255.255.0.

The external interface connects the FortiGate unit to ISP A and the Internet. It shares the ISP A subnet of 172.20.201.0/255.255.255.0.

 

 

To configure the vdomA interfaces – web-based manager:

1. Go to Global > Network > Interfaces.

2. Select Edit on the port1 interface.

3. Enter the following information and select OK:

Virtual Domain                          vdomA

Addressing mode                     Manual

IP/Netmask                                 172.20.201.2/255.255.255.0

4. Select Edit on the port4 interface.

5. Enter the following information and select OK:

Virtual Domain                          vdomA

Addressing mode                     Manual

IP/Netmask                                 10.11.101.2/255.255.255.0

 

To configure the vdomA interfaces – CLI:

config global

config system interface edit port1

set vdom vdomA

set mode static

set ip 172.20.201.2 255.255.255.0 next

edit port4

set vdom ABCDomain set mode static

set ip 10.11.101.2 255.255.255.0 end

 

Configuring the vdomB interfaces

The vdomB VDOM uses two FortiGate unit interfaces: port2 and port3.

The port2 interface connects the Company B internal network to the FortiGate unit, and shares the internal network subnet of 10.12.101.0/255.255.255.0.

The port3 interface connects the FortiGate unit to ISP B and the Internet. It shares the ISP B subnet of 192.168.201.0/255.255.255.0.

 

To configure the vdomB interfaces – web-based manager:

1. Go to Global > Network > Interfaces.

2. Select Edit on the port3 interface.

3. Enter the following information and select OK:

Virtual domain                           vdomB

Addressing mode                     Manual

IP/Netmask                                 192.168.201.2/255.255.255.0

4. Select Edit on the port2 interface.

5. Enter the following information and select OK:

Virtual domain                           vdomB

Addressing mode                     Manual

IP/Netmask                                 10.12.101.2/255.255.255.0

 

To configure the vdomB interfaces – CLI:

config global

config system interface edit port3

set vdom vdomB

set mode static

set ip 192.168.201.2 255.255.255.0 next

edit port2

set vdom vdomB

set mode static

set ip 10.12.101.2 255.255.255.0

end

 

Configuring the vdomA VDOM

With the VDOMs created and the ISPs connected, the next step is to configure the vdomA VDOM. Configuring the vdomA includes the following:

  • Adding vdomA firewall addresses
  • Adding the vdomA security policy
  • Adding the vdomA default route

 

Adding vdomA firewall addresses

You need to define the addresses used by Company A’s internal network for use in security policies. This internal network is the 10.11.101.0/255.255.255.0 subnet.

The FortiGate unit provides one default address, “all”, that you can use when a security policy applies to all addresses as the source or destination of a packet.

 

To add the vdomA firewall addresses – web-based manager:

1. In Virtual Domains, select vdomA.

2. Go to Policy & Objects > Addresses.

3. Select Create New.

4. Enter the following information and select OK:

Address Name                           Ainternal

Type                                            Subnet / IP Range

Subnet / IP Range                     10.11.101.0/255.255.255.0

Interface                                     port4

 

To add the ABCDomain VDOM firewall addresses – CLI:

config vdom edit vdomA

config firewall address edit Ainternal

set type ipmask

set subnet 10.11.101.0 255.255.255.0

end end

 

Adding the vdomA security policy

You need to add the vdomA security policy to allow traffic from the internal network to reach the external network, and from the external network to internal as well. You need two policies for this domain.

 

To add the vdomA security policy – web-based manager:

1. In Virtual Domains, select vdomA.

2. Go to Policy & Objects > IPv4 Policy.

3. Select Create New.

4. Enter the following information and select OK:

Name                                           VDOMA-internal-to-external

Incoming Interface                   port4

Outgoing Interface                   port1

Source Address                        Ainternal

Destination Address                 all

Schedule                                    Always

Service                                       ANY

Action                                         ACCEPT

5. Select Create New.

6. Enter the following information and select OK:

Name                                        VDOMA-external-to-internal

Incoming Interface                   port1

Outgoing Interface                   port4

Source Address                        all

Destination Address                 Ainternal

Schedule                                    Always

Service                                       ANY

Action                                         ACCEPT

 

To add the vdomA security policy – CLI:

config vdom edit vdomA

config firewall policy edit 1

set srcintf port4

set srcaddr Ainternal set dstintf port1

set dstaddr all

set schedule always set service ANY

set action accept set status enable

next edit 2

set srcintf port1 set srcaddr all set dstintf port4

set dstaddr Ainternal set schedule always set service ANY

set action accept set status enable

end

 

Adding the vdomA default route

You also need to define a default route to direct packets from the Company A internal network to ISP A. Every VDOM needs a default static route, as a minimum, to handle traffic addressed to external networks such as the Internet.

The administrative distance should be set slightly higher than other routes. Lower admin distances will get checked first, and this default route will only be used as a last resort.

 

To add a default route to the vdomA – web-based manager:

1. For Virtual Domains, select vdomA

2. Go to Network > Static Routes.

3. Select Create New.

4. Enter the following information and select OK:

Destination IP/Mask                 0.0.0.0/0.0.0.0

Device                                         port1

Gateway                                     172.20.201.7

Distance                                     20

 

To add a default route to the vdomA – CLI:

config vdom edit vdomA

config router static edit 1

set device port1

set gateway 172.20.201.7 end

 

Configuring the vdomB VDOM

In this example, the vdomB VDOM is used for Company B. Firewall and routing settings are specific to a single VDOM.

vdomB includes the FortiGate port2 interface to connect to the Company B internal network, and the FortiGate port3 interface to connect to ISP B. Security policies are needed to allow traffic from port2 to external and from external to port2 interfaces.

This section includes the following topics:

  • Adding the vdomB firewall address
  • Adding the vdomB security policy
  • Adding a default route to the vdomB VDOM

 

Adding the vdomB firewall address

You need to define addresses for use in security policies. In this example, the vdomB VDOM needs an address for the port2 interface and the “all” address.

 

To add the vdomB firewall address – web-based manager:

1. In Virtual Domains, select vdomB.

2. Go to Policy & Objects > Addresses.

3. Select Create New.

4. Enter the following information and select OK:

Address Name                           Binternal

Type                                            Subnet / IP Range

Subnet / IP Range                     10.12.101.0/255.255.255.0

Interface                                     port2

 

To add the vdomB firewall address – CLI:

config vdom edit vdomB

config firewall address edit Binternal

set type ipmask

set subnet 10.12.101.0 255.255.255.0 end

end

 

Adding the vdomB security policy

You also need a security policy for the Company B domain. In this example, the security policy allows all traffic.

 

To add the vdomB security policy – web-based manager:

1. Log in with a super_admin account.

2. In Virtual Domains, select vdomB.

3. Go to Policy & Objects > IPv4 Policy

4. Select Create New.

5. Enter the following information and select OK:

 

Name                                           VDOMB-internal-to-external

Incoming Interface                   port2

Outgoing Interface                   port3

Source Address                        Binternal

Destination Address                 all

Schedule                                    Always

Service                                       ANY

Action                                         ACCEPT

6. Select Create New.

7. Enter the following information and select OK:

Name                                           VDOMB-external-to-internal

Incoming Interface                   port3

Outgoing Interface                   port2

Source Address                        all

Destination Address                 Binternal

Schedule                                    Always

Service                                       ANY

Action                                         ACCEPT

 

To add the vdomB security policy – CLI:

config vdom edit vdomB

config firewall policy edit 1

set srcintf port2

end

set dstintf port3

set srcaddr Binternal set dstaddr all

set schedule always set service ANY

set action accept set status enable

edit 1

set srcintf port3 set dstintf port2 set srcaddr all

set dstaddr Binternal set schedule always set service ANY

set action accept set status enable

end

 

Adding a default route to the vdomB VDOM

You need to define a default route to direct packets to ISP B.

 

To add a default route to the vdomB VDOM – web-based manager:

1. Log in as the super_admin administrator.

2. In Virtual Domains, select vdomB.

3. Go to Network > Static Routes.

4. Select Create New.

5. Enter the following information and select OK:

Destination IP/Mask                 0.0.0.0/0.0.0.0

Device                                         port3

Gateway                                     192.168.201.7

Distance                                     20

 

To add a default route to the vdomB VDOM – CLI:

config vdom edit vdomB

config router static edit 1

set dst 0.0.0.0/0 set device external

set gateway 192.168.201.7 end

end

 

Testing the configuration

Once you have completed configuration for both company VDOMs, you can use diagnostic commands, such as tracert in Windows, to test traffic routed through the FortiGate unit. Alternately, you can use the traceroute command on a Linux system with similar output.

 

Possible errors during the traceroute test are:

  • “* * * Request timed out” – the trace was not able to make the next connection towards the destination fast enough
  • “Destination host unreachable” – after a number of timed-out responses the trace will give up

Possible reasons for these errors are bad connections or configuration errors. For additional troubleshooting, see Troubleshooting Virtual Domains.

Testing traffic from the internal network to the ISP

In this example, a route is traced from the Company A internal network to ISP A. The test was run on a Windows PC with an IP address of 10.11.101.55.

The output here indicates three hops between the source and destination, the IP address of each hop, and that the trace was successful.

From the Company A internal network, access a command prompt and enter this command:

C:\>tracert 172.20.201.7

Tracing route to 172.20.201.7 over a maximum of 30 hops:

1  <10 ms  <10 ms  <10 ms 10.11.101.2

2  <10 ms  <10 ms  <10 ms 172.20.201.2

3  <10 ms  <10 ms  <10 ms 172.20.201.7

Trace complete.