VDOM one box, many firewalls

Lessons · FortiGate series · VDOM tenants and admins

Hero · one chassis, two tenant panes, one global pane

Why creating a VDOM is not isolation

The day-one ticket is always the same: “We created TENANT-A, so they cannot see TENANT-B.” Wrong. config vdom / edit TENANT-A only names a context. Until you move an interface into it, all traffic still hits root. Until you bind the admin to a vdom-scope profile, that operator is still a global pair of hands.

Three silent-leak states look identical from the GUI (green VDOM list):

• VDOM exists; port2 is still set vdom root. TENANT-A has no ingress, so every packet is still root policy.
• Admin tenant-a-op uses super_admin or set vdom TENANT-A TENANT-B. The extra VDOM in the list is the leak, not a convenience.
• AVlnk is up and pings; there is no TENANT-A→AVlnk0 policy and no root AVlnk1→wan1 policy. Link ≠ permit. Same rule as any other interface pair.

VDOM, global, profile, link — four objects

A VDOM is an independent virtual unit: separate security policies and, in NAT mode, separate routing and VPN. FortiOS 6.2+ exposes this as vdom-mode: no-vdom (default), split-vdom (fixed root + FG-traffic), multi-vdom (root plus the tenants you create). Most models start at 10 VDOMs; more is a license. The management VDOM cannot be deleted.

In multi-VDOM you also pick a VDOM type: Traffic (packets), Admin (management only, no through-traffic, at most one), or LAN extension. This lab uses Traffic VDOMs plus root as the shared-WAN / management VDOM.

Path · split, then bind admin, then vdom-link, then prove

How a packet and an admin walk the split

Two paths, same chassis. A packet from 10.20.20.10 never sees TENANT-B’s policy table. An admin whose VDOM list is only TENANT-A never sees Global or TENANT-B, and can only HTTPS in on an interface that lives in TENANT-A (or the console).

Independent vs shared-WAN vs split-vdom

Pick the topology the contract actually bought. Mixing them is the usual “they have internet through my VDOM” ticket.

Runbook Side A / B / C

Side A is VDOMs and interfaces. Side B is admin profiles. Side C is the vdom-link, policy, and proof. Do not start at C — a link into a VDOM that still owns no LAN port is a black hole.

Side A — enable multi-vdom, create tenants, move ports

1. Turn on multi-vdom

   System › Settings › Virtual Domains (toggle). CLI: config system global / set vdom-mode multi-vdom. You are logged out. vdom-mode is a hidden command — type it in full; it will not tab-complete. Source: FortiOS Administration Guide — VDOM overview; Community TT: How to enable multiple VDOMs.

2. Create TENANT-A and TENANT-B

   Log back in as a super_admin. Global › System › VDOM › Create New. Type Traffic. CLI config vdom / edit TENANT-A. Management VDOM stays root unless you have a reason to move FortiGuard.

3. Move interfaces (global)

   Global › Network › Interfaces. port2 → VDOM TENANT-A, IP 10.20.20.1/24, allowaccess ping https ssh. port3 → TENANT-B 10.30.30.1/24. wan1 stays root 192.0.2.1/24. Address lives on the member, not on the VDOM name.

config system global
    set vdom-mode multi-vdom
end
# logged out — log back in as super_admin

config vdom
    edit TENANT-A
    next
    edit TENANT-B
    next
end
config global
    config system interface
        edit "port2"
            set vdom "TENANT-A"
            set ip 10.20.20.1 255.255.255.0
            set allowaccess ping https ssh
            set role lan
        next
        edit "port3"
            set vdom "TENANT-B"
            set ip 10.30.30.1 255.255.255.0
            set allowaccess ping https ssh
            set role lan
        next
        edit "wan1"
            set vdom "root"
            set ip 192.0.2.1 255.255.255.0
            set allowaccess ping https ssh
            set role wan
        next
    end
end
config vdom
    edit root
        config router static
            edit 1
                set gateway 192.0.2.254
                set device "wan1"
            next
        end
    next
end

Side B — profiles then per-VDOM admins

1. Custom vdom-scope profile

   System › Admin Profiles › Create New — tenant-admin. CLI set scope vdom, then fwgrp / netgrp read-write, loggrp read. Built-in prof_admin is already VDOM-scoped if you do not want a custom profile. Source: FortiOS — Administrator profiles; config system accprofile.

2. Bind tenant-a-op and tenant-b-op

   Virtual Domains = that tenant only. Repeat for TENANT-B. Keep global-ops as the only super_admin. Per-VDOM admins cannot backup/restore the box.

config global
    config system accprofile
        edit "tenant-admin"
            set scope vdom
            set fwgrp read-write
            set netgrp read-write
            set loggrp read
            set utmgrp read-write
        next
    end
    config system admin
        edit "tenant-a-op"
            set accprofile "tenant-admin"
            set vdom "TENANT-A"
            set password ENC <set_on_box>
        next
        edit "tenant-b-op"
            set accprofile "tenant-admin"
            set vdom "TENANT-B"
            set password ENC <set_on_box>
        next
    end
end

Side C — vdom-link, policy both sides, prove

1. Link pair + IPs

   config system vdom-link / edit AVlnk. Then config system interface on AVlnk0 (TENANT-A, 10.255.1.2/30) and AVlnk1 (root, 10.255.1.1/30), allowaccess ping. Same for BVlnk.

2. Routes and accept on both ends

   TENANT-A: default via 10.255.1.1 device AVlnk0. Policy LAN(port2)→AVlnk0 accept + NAT if you hide behind the link IP. Root: policy AVlnk1→wan1, src 10.20.20.0/24, accept, nat enable to 192.0.2.1. Reverse: wan1 is not a path into TENANT-A unless you add a VIP + policy — out of scope here.

3. Prove isolation, then prove internet

   Login as tenant-a-op on https://10.20.20.1. No Global menu, no TENANT-B. Then from 10.20.20.10 HTTPS to 203.0.113.80; in TENANT-A diagnose sys session filter src 10.20.20.10 / list — vd=TENANT-A. In TENANT-B the same filter is empty.

config global
    config system vdom-link
        edit "AVlnk"
        next
    end
    config system interface
        edit "AVlnk0"
            set vdom "TENANT-A"
            set ip 10.255.1.2 255.255.255.252
            set allowaccess ping
        next
        edit "AVlnk1"
            set vdom "root"
            set ip 10.255.1.1 255.255.255.252
            set allowaccess ping
        next
    end
end
config vdom
    edit TENANT-A
        config router static
            edit 1
                set gateway 10.255.1.1
                set device "AVlnk0"
            next
        end
        config firewall policy
            edit 1
                set name "LAN-to-AVlnk"
                set srcintf "port2"
                set dstintf "AVlnk0"
                set srcaddr "all"
                set dstaddr "all"
                set action accept
                set schedule "always"
                set service "ALL"
                set nat enable
                set logtraffic all
            next
        end
    next
    edit root
        config firewall address
            edit "TENANT_A_LAN"
                set subnet 10.20.20.0 255.255.255.0
            next
        end
        config firewall policy
            edit 10
                set name "AVlnk-to-WAN"
                set srcintf "AVlnk1"
                set dstintf "wan1"
                set srcaddr "TENANT_A_LAN"
                set dstaddr "all"
                set action accept
                set schedule "always"
                set service "ALL"
                set nat enable
                set logtraffic all
            next
        end
    next
end

One flow after go-live

Host 10.20.20.10 SYN to 203.0.113.80:443. Ingress port2, VDOM TENANT-A. Session miss. RIB default via 10.255.1.1, egress AVlnk0. Policy LAN-to-AVlnk accept, SNAT to 10.255.1.2 (if NAT on that policy). Packet arrives AVlnk1 in root. Root RIB default via 192.0.2.254, egress wan1. Policy AVlnk-to-WAN matches TENANT_A_LAN, accept, SNAT to 192.0.2.1. Two sessions, two vd= values. Reply reverses both hooks. TENANT-B’s table never sees the 5-tuple.

Admin path: tenant-a-op HTTPS to 10.20.20.1 (port2). Local-in in TENANT-A. GUI is VDOM:TENANT-A only. Same user to 192.0.2.1 is a miss — wan1 is root. global-ops HTTPS to wan1 sees the VDOM switcher.

Proof · isolation is two empty-or-not session tables, not a dashboard tile

get system status
# Virtual domain configuration: multiple / vdom-mode

config global
diagnose sys vd list
show system admin tenant-a-op
# accprofile tenant-admin
# vdom TENANT-A     <— TENANT-B must not appear

config vdom
edit TENANT-A
diagnose sys session filter clear
diagnose sys session filter src 10.20.20.10
diagnose sys session list
# vd=TENANT-A  policy_id=1
next
edit TENANT-B
diagnose sys session filter src 10.20.20.10
diagnose sys session list
# empty — if you see the flow here, the interface is in the wrong VDOM
end

Traps + proof

Sources

• FortiOS Administration Guide — VDOM overview (global vs VDOM settings, management VDOM, VDOM types, global vs per-VDOM administrators, inter-VDOM routing)
• FortiOS Administration Guide — Virtual Domains (independent units; default VDOM count / license)
• FortiOS Administration Guide — Create per-VDOM administrators (prof_admin or custom; login via assigned VDOM interface; multi-VDOM assignment at global; no super_admin at VDOM level)
• FortiOS Administration Guide — Administrator profiles (super_admin undeletable; System › Admin Profiles; config system accprofile)
• FortiOS CLI reference — config system accprofile (set scope {vdom | global})
• FortiOS Administration Guide — Inter-VDOM routing configuration example: Internet access (config system vdom-link, name0/name1, routes and policies per VDOM)
• Fortinet Community — Technical Tip: How to enable multiple VDOMs (set vdom-mode multi-vdom vs split-vdom; hidden command; GUI System › Settings)

Related: Zones, policy, NAT · VDOM tenant split · FortiGate command center · FortiGate interview