HostingmorethanoneFortiOSinstanceon

asingleFortiGateunitusingVDOMsand
VLANs
1. Network topology

UseVirtualdomains(VDOMs)todividetheFortiGateunitintotwoormorevirtualinstancesofFortiOS
thatfunctionsimilartoindependentFortiGateunits.EachVDOMhasitsownphysicalinterfaces,routing
configuration,andsecuritypolicies.

ThisexamplesimulatesanISPthatprovidesCompanyAandCompanyBwithInternetservicesandoffer
tothemdailynetworkmanagementandsecurityviaTLS(TransparentLANService)connections.Alsothe
ISPneedstoprotectitsserverssettopublicrouteableIPaddresses.
EachcompanywouldhaveitsownInternetIPaddressandinternalnetwork.Thisconfigurationrequires:

TwoVDOMs:VDOMAandVDOMBoperatinginNAT/Routemode,VDOMAforcompanyAand
VDOMBforcompanyB
OneVDOMCoperatingintransparentmodefortheISP

Thisscenariowillcoverthefollowingfeatures:

VDOMA:
o SettingupVLANStoseparateinternalnetworks
o ConfigureDHCPserveronVLANinterface

VDOMB:
o ConfigurelocalDNSserverresolvinginternalwebsitesandservers
o UseDHCPtoassignsomeIPsaccordingtodeviceMACaddresses
o Configuretrafficshapingforsensitivetraffic
o Configureexplicitwebproxyandwebcachingonsomenetwork

VDOMC:
o AllowingsecureaccesstoawebserverssettopublicIPaddress
o ProtectingthiswebserverusingUTMsecurityprofiles

2. Creating VDOMA, VDOMB and VDOMC

GotoSystem>Dashboard>StatusandenableVirtualDomain


GotoGlobal>VDOM>VDOMandaddVDOMA,VDOMB,VDOMCandamanagementIPforVDOMC
sinceitstransparent

Bydefault,rootisthemanagementVDOManditshouldhaveaninterfaceconnectedtotheinternetfor
managementtrafficsuchasFortiGuardservices,NTP,SNMP,etc.themanagementVDOMcanbemoved
toVDOMAorVDOMBorVDOMC.

TheadminaccounthasfullcontrolofallVDOMsintheFortiGateunit.Adminaccountcanaccessthe
FortiGateonanyinterfaceofanyVDOMasfarastheinterfacehasanIPaddressandallowinghttps
access.

GotoGlobal>Network>Interfaceandaddport1andport2toVDOMA

GotoRouter>Static>StaticRoutetoaddadefaultrouteforVDOMA

GotoGlobal>Network>Interfaceandaddport3andport4toVDOMB,andaddDHCPservertoport4

GotoRouter>Static>StaticRoutetoaddadefaultrouteforVDOMB

GotoGlobal>Network>Interfaceandaddport5andport6toVDOMC

GotoSystem>Network>RoutingTabletoaddadefaultrouteforVDOMC

GotoGlobal>Admin>AdministratorstocreateadministratorsforeachVDOM.Theadministrators
shouldonlyhaveaccesstotheirown

3. Configuring VDOMA using VLANs

LogontotheFortiGateunitVDOMAonport1orport2interfaceusingaadminaccount,thiswillletyou
manageonlyVDOMA

CompanyAseparatestheirthreeinternalnetworks(engineering,salesandmarketing)usingVLANs
ThissolutionusesVLANstoconnectthreenetworkstoVDOMAinternalinterfaceinthefollowingway:

PacketsfromeachnetworkpassthroughaVLANswitchbeforereachingtheVDOMA.TheVLAN
switchaddsdifferentVLANtagstopacketsfromeachnetwork.
TohandleVLANsonVDOMA,addVLANinterfacestotheinternalinterfaceforeachnetwork
AddaDHCPservertoeachVLANinterface.
CreatesecuritypoliciestoalloweachnetworktoaccesstheInternet.

ThissolutionassumesyouhaveconfiguredaVLANswitchtotagpacketsfromthethreenetworks

GotoSystem>Network>Interfacetocreatethreenewvlaninterfacesforengineering,marketingand
salesnetworks

GotoPolicy>Policy>Policytoaddfirewallpoliciesthatallowsusersontheengineering,marketingand
salesnetworkstoaccesstheinternetseparately

4. Showing results

FromengineeringnetworksetallhostsIPsinthesamesubnetastheEngineeringnetvlan
(192.168.10.x/24)withthegateway192.168.10.1orsethoststouseDHCP

FrommarketingnetworksetallhostsIPsinthesamesubnetastheMarketingnetvlan
(192.168.20.x/24)withthegateway192.168.20.1orsethoststouseDHCP
AndfromsalesnetworksetallhostsIPsinthesamesubnetastheSalesnetvlan(192.168.30.x/24)
withthegateway192.168.30.1orsethoststouseDHCP

ThenusersfromanyofthenetworksshouldbeabletoconnecttotheInternet

Policy>Policy>Policytoseetrafficcountforeachfirewallpolicy

GotoPolicy>Monitor>PolicyMonitortoseetheactivesessions


ClickoneachbluebarfordetailsforsourceIPandpolicyId

GotoLog&Report>TrafficLog>ForwardTraffic

Selectanentryformoredetails

5. Configuring VDOMB

LogontotheFortiGateunitVDOMBonport3orport4interfaceusingbadminaccount,thiswillletyou
manageonlyVDOMB

CompanyBrequiresreservedIPaccordingtodeviceMACaddressusingDHCP,localDNSserver,
guaranteedbandwidthforsensitivetrafficandfasterwebbrowsing.Consequentlythefollowing
featureswillbecovered:

DHCPservertoassignsomeIPaddressesaccordingtodeviceMACaddresses
LocalDNSserverlistingforinternalwebsitesandservers
Trafficshapingtomakesurehighpriorityservicesalwayshaveenoughbandwidth
Explicitwebproxyandwebcachingusersonsomenetworks

6. Configure DHCP to assign some IP addresses according to device

MAC addresses

GotoSystem>Network>DHCPServerandaddnewfortheinternalinterface(port4)

MakesuretospecifytheDNSServertotheinternalIPoftheFortiGateVDOMB(10.10.1.99).Thiswillbe
usefultoresolveinternalDNSrequests

ExtendMACAddressAccessControlListandcreateanewthenentertheMACaddressofthedevice
anditsdesiredreservedIPaddress.YoucanalsouseAddfromDHCPClientList

7. Creating a local DNS server listing for internal web sites and
servers

GotoSystem>Network>DNSServerandcreatenewunderDNSServiceonInterface.Makesureto
setModetoRecursive

ThencreatenewunderDNSDatabaseandaddDNSZoneandDomainName

ThencreatenewunderDNSEntriesandaddhostnames

TheDNSzonewillbelookinglikefollowing:

Fromanyhostontheinternalnetwork,setyournetworkconnectionstousetheinternalinterfaceof
FortiGateVDOMBIPaddress(10.10.1.99)asaprimaryDNSserver,thenyouwillbeabletosurftothe
webserverusingitsIPaddress(10.10.1.101)anditsdomainname(fortidocs.comor
www.fortidocs.com)

8. Configuring guaranteed bandwidth for sensitive traffic using traffic

shaping

Sensitivetraffic,suchasVoIP,flowingthroughtheFortigateVDOMBneedstohaveenoughguaranteed
bandwidthtoassurethevoicequality.

ThisscenarioinvolvestrafficshapingforVoIP/SIPtraffic.ToseehowtoconfigureSIPontheFortiGate
unit,refertoAllowinginboundandoutboundVoIP/SIPtrafficthroughtheFortiGaterecipe.

Usingtrafficshaping,youcanconfiguresharedshapersthatensureaconsistentamountofreserved
bandwidthforVoIP/SIPcommunicationsandstillmaintainbandwidthforotherInternettrafficsuchas
emailandwebbrowsing.Dependsthetotalavailablebandwidthyouhaveyoucandedicatea
guaranteedandamaximumbandwidthforeachfirewallpolicy(youcanverifyyourtotalbandwidth
usinghttp://speedtest.net/).Forthissolution,totalavailablebandwidthis70000Kbits/s,10000kbits/s
isguaranteedtobeavailableforVoIPandVoIPtrafficisgivenhigherprioritythanothertraffic.Other
trafficislimitedtoamaximumbandwidthof600000kbits/s.
InthisconfigurationtheinternalIPphonesandinternalnetworkareconnectedtotheFortiGateVDOM
Binternalinterface(port4).

GotoFirewallObjects>TrafficShaper>SharedandVoIPandDaily_TrafficShapers

GotoPolicy>Policy>PolicyandapplytheVoIPtrafficshapertothefirewallpolicycontrollingVoIP/SIP
traffic


ThenapplytheDaily_Trafficshapertothefirewallpolicycontrollingothertraffic


GotoFirewallObjects>Monitor>TrafficShaperMonitor


GotoLog&Report>TrafficLog>ForwardTraffictoseethatVoIPandDaily_Trafficshaperswere
appliedsuccessfully

Selectanentryforeachshapertoseedetails

9. Adding the explicit web proxy and web caching on the internal
network

Forfasterwebbrowsing,internaluserswillconnecttoanexplicitwebproxyusingport8080insteadof
surfingdirectlytotheInternetusingport80

GotoSystem>Network>ExplicitProxyandenablehttp/httpsexplicitwebproxy

MakesuretosettheDefaultFirewallPolicyActionheretoDeny,becausewewillcreateapolicyfor
webproxytrafficwithwebcacheenabledonit.

GotoSystem>Network>Interfaceandenablewebproxyonport4

GotoPolicy>Policy>Policytocreatenewoneforwebproxytrafficandenablewebcache

Configurewebbrowsersontheprivatenetworktoconnecttothenetworkusingaproxyserver.TheIP
addressoftheHTTPproxyserveris10.10.1.99(theIPaddressoftheFortiGateinternalinterface)and
theportis8080(thedefaultexplicitwebproxyport).

WebbrowsersconfiguredtousetheproxyserverareabletoconnecttotheInternet.

Gotopolicy>Policy>PolicytoseetheIDofthepolicyallowingwebproxytraffic(hereitsID3)

Webproxytrafficisnotcountedbyfirewallpolicy!

GotoLog&Report>TrafficLog>ForwardTrafficandfilterbypolicyID3

Selectanentryfordetails

10.

Configuring VDOMC

ThisVDOMCintransparentmodewillbesettoprotecttheISPsserverssettopublicIPsusingUTM
Profiles

LogontotheFortiGateunitVDOMConport5interface(managementIP172.20.120.23)usingcadmin
account,thiswillletyoumanageonlyVDOMC

GotoFirewallObjects>Address>AddresstosetwebserverIP

GotoPolicy>Policy>PolicytocreateoneforoutboundtrafficandapplyUTMsecurityprofilesthen
anotheroneforinboundtrafficwithsecurityUTMprofilesaswell


Youcanusethedefaultprofilesandcustomizethemifyouwantto.

YoucannowconnecttoyourwebserversecurelyfromtheinternetusingitspublicIPaddress
(eventuallyusingthesameFQDN)althoughthewebserverisbehindaFortiGateunit.Alsotheweb
serverisabletoconnecttotheinternetforupdatesandothers.

GotoLog&Report>TrafficLog>ForwardTraffictoseeinandoutboundtraffic


Selectanentryforoutboundandanotherentryforinboundtrafficfordetails

GotoUTMSecurityProfiles>MonitortoseeallUTMstatus

HereisanexampleofApplicationmonitorfromthatwebserverwithIPaddress172.20.120.226