Fortinet Gate 60D, Administration Manual

Page: 103 / 706

Using virtual domains Virtual domains
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424
103
http://docs.fortinet.com/ • Feedback
Using virtual domains
This section describes virtual domains (VDOMs) along with some of their benefits, and
how to use VDOMs to operate your FortiGate unit as multiple virtual units.
If you enable VDOMs on the FortiGate unit, you configure virtual domains globally for the
FortiGate unit.
To get started working with virtual domains, see “Enabling VDOMs” on page 108 .
This section describes:
• Virtual domains
• Enabling VDOMs
• Configuring global and VDOM resource limits
• Configuring VDOMs and global settings
Virtual domains
Virtual domains (VDOMs) are a method of dividing a FortiGate unit into two or more virtual
units that function as multiple independent units. A single FortiGate unit is then flexible
enough to serve multiple departments of an organization, separate organizations, or to act
as the basis for a service provider’s managed security service.
Benefits of VDOMs
Some benefits of VDOMs are:
• Easier administration
• Continued security maintenance
• Savings in physical space and power
Easier administration
VDOMs provide separate security domains that allow separate zones, user authentication,
firewall policies, routing, and VPN configurations. Using VDOMs can also simplify
administration of complex configurations because you do not have to manage as many
routes or firewall policies at one time. For more information, see
“VDOM configuration
settings” on page 104 .
By default, each FortiGate unit has a VDOM named root. This VDOM includes all of the
FortiGate physical interfaces, modem, VLAN subinterfaces, zones, firewall policies,
routing settings, and VPN settings.
Also you can assign an administrator account restricted to that VDOM. If the VDOM is
created to serve an organization, this feature enables the organization to manage its own
configuration.
Management systems such as SNMP, logging, alert email, FDN-based updates and NTP-
based time setting use addresses and routing in the management VDOM to communicate
with the network. They can connect only to network resources that communicate with the
management virtual domain. The management VDOM is set to root by default, but you
can change it. For more information, see
“Changing the management VDOM” on
page 116 .