FortiGate Administration Guide - FirewallShop.com

Interface
System Network
Inter-vdom interface
Virtual domains (VDOMs) help to separate traffic based on your needs. The intervdom
interface is used to connect two virtual domains without using a physical
interface. VDOMs must be enabled before you can create an inter-vdom interface.
Traffic between VDOMs over an inter-vdom interface has to leave and re-enter
through the firewall maintaining the established level of security of physical
interfaces on your FortiGate unit.
Before inter-vdom interfaces, the number of physical interfaces limited the
possible configurations. Inter-vdom links are virtual interfaces, removing that limit.
If your FortiGate unit has many VDOMs, inter-vdom interfaces allow you to
configure things however you need from a simple stand alone VDOM
configuration to a complex meshed VDOM configuration. For more information,
see the FortiGate VLANs and VDOMs User Guide.
When creating the inter-vdom interface, there are two ends to configure - one
connects to each VDOM.The CLI command to configure an inter-vdom interface
or link interface called link1 that connects root VDOM to vdom1:
config global
config system vdom-link
edit link1
config system interface
edit link10
set vdom root
next
edit link11
set vdom vdom1
next
end
For more information, see config system interface in the FortiGate CLI Reference.
Additional configuration for interfaces
Once the interface is selected with the basic settings configured, some additional
configuration may be considered. Additional configuration for an interface consists
of setting:
• Administrative access to an interface
• Interface MTU packet size
• Traffic logging for an interface
• Secondary IP Addresses
Administrative access to an interface
For a VDOM running in NAT/Route mode, you can control administrative access
to the interfaces in that VDOM.
You can allow remote administration of the FortiGate unit. However, allowing
remote administration from the Internet could compromise the security of the
FortiGate unit. You should avoid this unless it is required for your configuration. To
improve the security of a FortiGate unit that allows remote administration from the
Internet:
FortiGate Version 3.0 MR5 Administration Guide
94 01-30005-0203-20070830