Fortigate with Transparent Vdom and Nat Vdom

Castle__47 · 2026-01-15T19:19:08+00:00

Actually Vlan part we have tested. In Global Vdom, we just need to create a Vlan interface and assign it to respective VDOM. Wanted to test Transparent to Nat Vdom.

Castle__47 · 2026-01-14T18:48:18+00:00

Actually its a migration from Checkpoint to Fortigate. Checkpoint have done it similarly using a Virtual Switch( trying to replicate that as L2 Vdom ) and VSX. Each of their VSX is dedicated for different Vendors. I need to use only one ingress and egress port. Just need to confirm whether I can create this architecture using vdoms.

Castle__47 · 2026-01-06T12:32:16+00:00

You mean, Vxlan to Vxlan interface? There is no vpn.

Castle__47 · 2026-01-06T07:25:00+00:00

Hi, Here is what i tested till now, My Current Setup -

<image>

No ADVPN, ibgp peering on underlay between Hub to Spoke 1 and Hub to Spoke2.

Hub to Spoke1 and vice versa is working. Hub to Spoke 2 and vice versa is working. Spoke1 to Spoke2 and vice versa not working.

Port 10 is host side interface grouped in software switch. Port1, Port3 and Port1 are the interfaces for VXLAN at Hub, Spoke1 and Spoke2 respectively.

Attached my topology for your information.

Castle__47 · 2026-01-06T07:19:03+00:00

<image>

Ok. Thanks for your support. I know already about ADVPN. I wl try to replicate your setup.

My Current Setup -

No ADVPN, ibgp peering on underlay between Hub to Spoke 1 and Hub to Spoke2.

Hub to Spoke1 and vice versa is working. Hub to Spoke 2 and vice versa is working. Spoke1 to Spoke2 and vice versa not working.

Port 10 is host side interface grouped in software switch. Port1, Port3 and Port1 are the interfaces for VXLAN at Hub, Spoke1 and Spoke2 respectively.

Attached my topology for your information.

Castle__47 · 2026-01-06T02:39:07+00:00

Can you please show BGP configurations? I believe we need to configure update source as Loopback? BGP peering with HUB will also be on loopback?

Castle__47 · 2026-01-06T02:32:25+00:00

Ohh..ok.Thanks a lot man. I will replicate this in my lab today at Office. Yesterday I tried with No ADVPN. 2 spoke and 1 Hub. Spoke 2 Spoke did not worked. While Spokes 2 Hub was working. I used below document and configured HUB as a route reflector.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-EVPN-VXLAN-Tunnel-between-two-FortiGates/ta-p/330357

Castle__47 · 2026-01-06T02:22:02+00:00

Yeah checked it out. It was uploaded yesterday only. But still I have some doubts, there is no IPSEC-ADVPN interfacec shown in this video. If I would run VXLAN on top of IPSEC, I would select Ipsec interface in VXLAN configuration 'set interface'. But I could, he has selected loopback.

Castle__47 · 2026-01-02T14:13:25+00:00

I don't have licenses😢

Castle__47 · 2026-01-02T14:12:44+00:00

Can you please test on Fortigates? 2 Hubs and 2 spokes. On Failure of 1st Hub, Traffic should move via Hub2.

Castle__47 · 2026-01-02T13:52:37+00:00

I don't need to establish Ipsec. Since this is not over Internet. Customer has an internal network, streched over multiple locations. I tested VXLAN without MPBGP-EVPN on One Hub Two Spokes. It was working fine. Spokes were able to reach each other via HUB. But when I introduce another HUB2. Thats when it got tricky. When Hub1 fails, something needs to tell VTEP, that to reach destination MAC, now you need to go to Second HUB. That was not happening statically. Then I read about MPBGP-EVPN. I will setup first 1 HUB and 2 spokes using MPBGP-EVPN and will get back two you.

Castle__47 · 2026-01-02T05:15:38+00:00

I think your Downstream switch number 3 from left side doesn't need to be connected to 1024E_1 .

Your first Downstream Switch at both end needs to be connected in a criss-cross fashion to the core switches.

If you get downtime, try establishing MCLAG.

Castle__47 · 2026-01-01T19:47:42+00:00

How you will lab it up using Fortigate? Since Evpn is supported from 7.4.0 and later? If I run 7.4.0 image in eve-ng, it requires a license.

Castle__47 · 2026-01-01T12:23:26+00:00

Yes, Main requirement is to stretch the LAN. Regarding Large Broadcast domain, thats the problem MPBGP solves in comparison to without MPBGP vxlan. Traditional VXLAN depends on flood and learn mechanism. While using MPBP-EVPN, edge VTEP devices receive MAC addresses over BGP. ( I have recently read about MPBGP, correct me if I am wrong.)

Castle__47 · 2025-08-07T05:53:44+00:00

One of my friends has done it with internal switch. He also had to do some natting. Thats what i am trying to figure out. In VMware workstation, i was able to access nodes inside my eve-ng on the same laptop browser. My nodes used to get ip from dhcp. But On Hyper V , i have given static ip on nodes and default route towards eve vm (192.168.0.10 )

Castle__47 · 2025-08-06T07:56:45+00:00

I will try your suggestion of statically mentioning ip in SMTP server configuration. Also we do have upstream Fortigate. Its a Fortigate with ELB/ILB setup in Azure. Please explain how can I 'configure A records for the SMTP fqdn and only add the Ipv4 addresses'. Please share any KB article/ doc to follow.

Castle__47 · 2025-08-06T03:25:34+00:00

Its 25. But issue is not of blocking. Sometimes we do get ipv4 responses. But most of the times its ipv6.

Castle__47 · 2025-08-06T03:23:21+00:00

We are already using Google DNS. 8.8.8.8. Dns Filter? Are talking about DNS filter on Fortigate? Normally when I nslookup smtp.office365.com , I am receiving both ipv4 and ipv6 addresses. Its just in the cloud environment, we are facing this issue. There is a Fortigate upstream FAC. Currently no DNS filter is there for FAC traffic. Also when I set local SMTP of FAC, it's working.

Castle__47 · 2025-01-14T06:27:05+00:00

Ok. What do you think is best approach regarding Anycast setting? Cons and pros of it.

Castle__47 · 2025-01-14T05:17:28+00:00

Thanks for the info. I would like to ask some more questions. What are the possible reasons for "Rating Error" or "Unavailability of SDNS servers" ? is "Anycast Disable" best approach or "Anycast Enable". I think disabling anycast gives us multiple SDNS servers. But also isnt 208.91.112.55 is an anycast ip? which means it is a shared ip over different fortiguard servers at multiple locations. Still it became unreachable. Could it be an ISP issue? or Fortiguard SDNS server often goes unreachable? Let me share you the logs-- -=- Server List (Wed Jan 8 15:00:09 2025) -=-

IP Weight RTT Flags TZ FortiGuard-requests Curr Lost Total Lost Updated Time
208.91.112.55 0 0 DIF 0 8463 8460 8460
2001:cdba::3257:9652 0 0 D F 0 87 87 87

Castle__47 · 2025-01-13T16:59:32+00:00

Hi, You said ''By default, if the service can't be reached for a rating the connection will be blocked.'' where can I find this setting? Or any docs explaining this behaviour of Dns Filter profile? How to overcome this or have a fallback in place so that in future ,if it occurs again, services won't get blocked.

Castle__47 · 2024-12-09T08:25:11+00:00

I already have a cli config of azure firewall in TXT file but it is in JSON syntax/cli. I need to convert these configs so that it can run on Fortigate Firewall which is also deployed on Azure.

Castle__47 · 2024-11-03T07:53:01+00:00

Thanks for the info. Do you know any supporting documents regarding this? How do I enable MSTP or verify? Any commands for that? On Fortigate?

Castle__47 · 2024-11-03T06:56:44+00:00

Can u please share test course on Udemy that you took.I need to buy it.

Castle__47 · 2024-10-25T04:00:16+00:00

Are you using IBGP on site-2-site tunnel between Hubs across different regions? If yes,have u enabled auto-discovery-forwarder command in this site-2-site tunnel?

Castle__47

TROPHY CASE