I85PREP
⌘ K
FCSS Enterprise Firewall 7.6 study materials
FCSS Enterprise Firewall 7.6 study resources

FCSS Enterprise Firewall 7.6: Virtual Domains (VDOMs)

FCSS Enterprise Firewall 7.6 · Work through your exam, one topic at a time.

All guide sections

Virtual Domains (VDOMs)

Virtual Domains (VDOMs)

VDOMs tests multi-tenancy: how to split one FortiGate into independent virtual firewalls, what is global versus per-VDOM, how VDOMs exchange traffic, and how to stop one tenant consuming all resources. Expect questions on the admin VDOM, inter-VDOM links, VDOM types and resource guarantees.

Core rules

  • Enabling. config system global, set vdom-mode multi-vdom; on most builds this requires a reboot and resets the configuration. The default VDOM is root, and an admin VDOM can hold the management plane.
  • Scope. Global scope (config global) holds HA, administrator accounts, VDOM definitions and VDOM properties. Interfaces, routes, policies, profiles, users and logs live inside a VDOM. Objects are not shared, so profiles must be recreated or scripted per VDOM.
  • Inter-VDOM links. Created in global scope (config system vdom-link), producing two ends; assign one end to each VDOM, then route and apply policy on both sides. This is the supported way to pass traffic between VDOMs.
  • VDOM types. Traffic VDOMs forward packets; admin-type VDOMs are management only. Split-task VDOMs separate management work from data-plane work.
  • Resource limits. In global scope, config system vdom-property sets guaranteed and maximum values per VDOM for sessions, IPsec tunnels, SSL VPN, users and similar counters.
  • Administrators. config system admin with set vdom restricts an administrator to one VDOM; super_admin sees all VDOMs.

Worked example

An MSSP hosts five customers. Create five traffic VDOMs, keep the internet edge and shared NAT in a sixth VDOM, and build one inter-VDOM link pair per customer. Each customer VDOM gets a default route pointing at its own link end; the edge VDOM holds the policies and source NAT toward the ISP. Reasoning: routing tables are per-VDOM, so each tenant's default must point at its own link, and NAT must occur where traffic leaves for the internet.

Traps

Creating the inter-VDOM link inside a VDOM instead of global scope; expecting the admin VDOM to route traffic; forgetting the VDOM selector in the GUI and editing the wrong tenant; neglecting vdom-property limits so one VDOM exhausts the session table; assuming HA can be scoped per VDOM on every model.