Fortinet black logo

CLI Reference

Appendix A: Virtual domains

Appendix A: Virtual domains

This appendix describes CLI commands when you use the virtual domains feature. It includes the following topcis:

Overview

You can use virtual domains (VDOMs) to delegate administration for tenant deployments. This can be useful for large enterprises and multi-tenant deployments such as web hosting.

Virtual domains are not enabled by default. Enabling and configuring VDOMs can only be performed by the admin administrator.

VDOMs alter the structure and available functions in the GUI and CLI, according to whether or not you are logging in as the admin administrator, and, if you are not logging in as the admin administrator, the administrator account’s assigned access profile.

Differences between administrator accounts when VDOMs are enabled

admin account Other administrators

Access to config global

Yes

No

Can create administator accounts

Yes

No

Can create and enter all VDOMs

Yes

No

If VDOMs are enabled and you log in as admin, the complete set of CLI commands appear, allowing unrestricted access and VDOM configuration. The admin administrator account cannot be restricted to a VDOM. Other administrators are restricted to their VDOM, and cannot configure VDOMs or global settings.

If VDOMs are enabled and you log in as any other administrator, you enter the VDOM assigned to your account. By default, administrator accounts other than the admin account are assigned to the root VDOM. A subset of the typical menus or CLI commands appear, allowing access only to only feature configuration, logs and reports specific to your VDOM. You cannot access global configuration settings or enter other VDOMs.

Enabling VDOMs

Before you begin:

  • Save a backup of the configuration. Enabling VDOMs changes the structure of your configuration, so you want to be able to easily revert to the system state before VDOMs were enabled.
To enable VDOMs
  1. Log in with the admin account.
  2. Other administrators do not have permissions to configure VDOMs.

  3. Enter the following commands:
  4. config system global

    set vdom-admin enable

    end

    FortiADC terminates your administrative session.

  5. Log in again.
  6. When VDOMs are enabled, and if you log in as admin, the top level of the shell changes: the two top level items are config global and config vdom.

  • config global contains settings that only admin or other accounts with the prof_admin access profile can change.
  • config vdom contains each VDOM and its respective settings.

This menu and CLI structure change is not visible to non-global accounts; VDOM administrators’ navigation menus continue to appear similar to when VDOMs are disabled, except that global settings such as network interfaces, HA, and other global settings do not appear.

  • Continue by defining VDOMs.
  • Creating VDOMs

    Some settings can only be configured by the admin account — they are global. Global settings apply to the appliance overall regardless of VDOM, such as:

    • network interfaces
    • system time
    • backups
    • administrator accounts
    • access profiles
    • FortiGuard connectivity settings
    • HA and configuration sync
    • SNMP
    • X.509 certificates
    • TCP SYN flood anti-DoS setting
    • exec ping and other global operations that exist only in the CLI

    Only the admin account can configure global settings.

    Other settings can be configured separately for each VDOM. They essentially define each VDOM. For example, the policies of VDOM-A are separate from VDOM-B.

    Initially, only the root VDOM exists, and it contains settings such as policies that were global before VDOMs were enabled. Typically, you will create additional VDOMs, and few if any administrators will be assigned to the root VDOM. After VDOMs are created, the admin account usually assigns other administrator accounts to configure their VDOM-specific settings. However, as the root account, the admin administrator does have permission to configure all settings, including those within VDOMs.

    To create a VDOM:
    1. Log in with the admin account.
    2. Other administrators do not have permissions to configure VDOMs.

    3. Enter the following commands:

    config vdom

    edit <VDOM_name>

    where <VDOM_name> is the name of your new VDOM. (Alternatively, to configure the default root VDOM, type root.

    The new VDOM exists, but its settings are not yet configured.

    Editing a VDOM

    You can modify the dynamic and static parameters of each VDOM by following the instructions below. Dynamic parameters determine how much of a dynamic resource, such as connections per second, a VDOM can use. Static parameters determine how much of a static resource, such as real servers, a VDOM can use.

    To edit a VDOM:

    1. Enable vdom

    2. Execute the following commands. A value of 0 means the parameter has no limit.

    config global

    config system vdom

    edit <VDOM_name>

    L4CPS : 0

    L7CPS : 0

    L7RPS : 0

    SSLCPS : 0

    SSLTHROUGHPUT : 0

    CONCURRENTSESSION : 0

    virtualserver : 0

    realserver : 0

    healthcheck : 0

    sourcepool : 0

    errorpage : 0

    localuser : 0

    usergroup : 0

    INBOUND : 0

    OUTBOUND : 0

    Dynamic parameters

    L4CPS

    The number of layer 4 connections created per second. When the creation speed exceeds this value, only this number of connections will be created per second. The rest will be dropped.

    L7CPS

    The number of layer 7 TCP connections created by the httproxy frontend per second. When the creation speed exceeds this value, only this number of connections will be created per second. Additional TCP syn requests will be dropped on the client side.

    L7RPS

    The number of HTTP GET requests handled by the httproxy from the client side per second. When the number of requests per second exceeds this value, only this number of requests will be handled. Additional HTTP GET requests will be dropped.

    SSLCPS

    The number of SSL connections created by the httproxy frontend per second. When the creation speed of new SSL connections exceeds this value, only this number of connections will be created per second. Additional connections will not be allowed and additional syn packets will be dropped during that second.

    SSLTHROUGHPUT

    The volume of SSL encrypted TCP traffic from both the incoming and outgoing side. When the traffic throughput exceeds this value, additional packets from the client will be dropped and new connections will not be allowed.

    CONCURRENTSESSION

    The total number of living connections for ADC traffic. Living connections include L4, L7, and L7 SSL. When the number of living connections exceeds this number, additional connections will not be allowed.

    INBOUND

    The maximum volume of inbound traffic allowed. Only L4 and L7 SLB TCP traffic will be counted.

    OUTBOUND

    The maximum volume of outbound traffic allowed. Only L4 and L7 SLB TCP traffic will be counted.

    Static parameters

    virtualserver

    The maximum number of virtual servers that can be configured using "config load-balance virtual-server" in the chosen VDOM.

    realserver

    The maximum number of real servers that can be configured using "config load-balance real-server" in the chosen VDOM.

    healthcheck

    The maximum number of healthcheck members that can be configured using "config system health-check" in the chosen VDOM.

    sourcepool

    The maximum number of IP pools that can be configured using "config load-balance ippool" in the chosen VDOM.

    errorpage

    The maximum number of error page files that can be configured using "config load-balance error-page" in the chosen VDOM.

    localuser

    The maximum number of local users that can be configured using "config user local" in the chosen VDOM.

    usergroup

    The maximum number of user groups that can be configured using "config user user-group" in the chosen VDOM.

    Assigning interfaces to a VDOM

    The following commands assign a network interface to a VDOM:

    FortiADC-VM # config global

    FortiADC-VM (global) # config system interface

    FortiADC-VM (interface) # edit port10

    FortiADC-VM (port10) # set vdom docs-vdom

    FortiADC-VM (port10) # end

    Changing interface(port10) vdom from root(1) to docs-vdom(233):

    change vdom success.

    Assigning administrators to a VDOM

    The following commands create an administrator account and assign the administrator to a vdom:

    FortiADC-VM # config global

    FortiADC-VM (global) # config system admin

    FortiADC-VM (admin) # edit docs-vdom-admin

    Add new entry 'docs-vdom-admin' for node 78

    FortiADC-VM (docs-vdom-admin) # set access-profile admin_prof

    FortiADC-VM (docs-vdom-admin) # set vdom docs-vdom

    FortiADC-VM (docs-vdom-admin) # end

    Disabling VDOMs

    Before you begin:

    • Save a backup of the configuration. Disabling VDOMs changes the structure of your configuration, and deletes most VDOM-related settings. It keeps settings from the root VDOM only.
    To disable VDOMs
    1. Assign interfaces to the root VDOM. For example:
    2. FortiADC-VM # config global

      FortiADC-VM (global) # config system interface

      FortiADC-VM (interface) # edit port10

      FortiADC-VM (port10) # set vdom root

      FortiADC-VM (port10) # end

      Changing interface(port10) vdom from docs-vdom(233) to root(1):

      change vdom success.

    3. Assign admin accounts to the root VDOM or delete them. For example:
    4. FortiADC-VM (global) # config system admin

      FortiADC-VM (admin) # delete docs-vdom-admin

      FortiADC-VM (admin) # end

    5. Delete non-root VDOMs:
    6. FortiADC-VM # config vdom

      FortiADC-VM (vdom) # delete docs-vdom

      FortiADC-VM (vdom) # end

    7. Disable VDOMs:

    FortiADC-VM # config global

    FortiADC-VM (global) # config system global

    FortiADC-VM (global) # set vdom-admin disable

    FortiADC-VM (global) # end

    The system disables VDOMs and terminates your administrative session.

    Viewing VDOMs

    Use the following command to show the usage and settings for all VDOMS on the system:

    get system vdom-status

    The following example shows the system with two VDOMs set.

    FortiADC-300D # get system vdom-status

    root:

    l4cps: 4.87/-

    l7cps: 90.2/-

    l7rps: 0.0/-

    SSLcps: 3.7/-

    SSLThroughput(KB/S): 1550.0/-

    ConcurrentSession: 47.0/-

    Inbound(KB/S): 255.6/-

    Outbound(KB/S): 104669.0/-

    VirtualServer: 21/-

    RealServer: 33/33

    Health Check: 5/-

    Source Pool: 0/-

    Error-Page: 1/-

    LocalUser: 0/-

    UserGroup: 2/-

    vdom1:

    l4cps: 0.0/-

    l7cps: 0.0/-

    l7rps: 0.0/-

    SSLcps: 0.0/-

    SSLThroughput(KB/S): 0.0/-

    ConcurrentSession: 0.0/-

    Inbound(KB/S): 0.0/-

    Outbound(KB/S): 0.0/-

    VirtualServer: 0/-

    RealServer: 0/-

    Health Check: 4/-

    Source Pool: 0/-

    Error-Page: 0/-

    LocalUser: 0/-

    UserGroup: 0/-

    The first number represents the current usage. The second number represents the limit set. A dashed line means no limit has been set.

    Appendix A: Virtual domains

    This appendix describes CLI commands when you use the virtual domains feature. It includes the following topcis:

    Overview

    You can use virtual domains (VDOMs) to delegate administration for tenant deployments. This can be useful for large enterprises and multi-tenant deployments such as web hosting.

    Virtual domains are not enabled by default. Enabling and configuring VDOMs can only be performed by the admin administrator.

    VDOMs alter the structure and available functions in the GUI and CLI, according to whether or not you are logging in as the admin administrator, and, if you are not logging in as the admin administrator, the administrator account’s assigned access profile.

    Differences between administrator accounts when VDOMs are enabled

    admin account Other administrators

    Access to config global

    Yes

    No

    Can create administator accounts

    Yes

    No

    Can create and enter all VDOMs

    Yes

    No

    If VDOMs are enabled and you log in as admin, the complete set of CLI commands appear, allowing unrestricted access and VDOM configuration. The admin administrator account cannot be restricted to a VDOM. Other administrators are restricted to their VDOM, and cannot configure VDOMs or global settings.

    If VDOMs are enabled and you log in as any other administrator, you enter the VDOM assigned to your account. By default, administrator accounts other than the admin account are assigned to the root VDOM. A subset of the typical menus or CLI commands appear, allowing access only to only feature configuration, logs and reports specific to your VDOM. You cannot access global configuration settings or enter other VDOMs.

    Enabling VDOMs

    Before you begin:

    • Save a backup of the configuration. Enabling VDOMs changes the structure of your configuration, so you want to be able to easily revert to the system state before VDOMs were enabled.
    To enable VDOMs
    1. Log in with the admin account.
    2. Other administrators do not have permissions to configure VDOMs.

    3. Enter the following commands:
    4. config system global

      set vdom-admin enable

      end

      FortiADC terminates your administrative session.

    5. Log in again.
    6. When VDOMs are enabled, and if you log in as admin, the top level of the shell changes: the two top level items are config global and config vdom.

    • config global contains settings that only admin or other accounts with the prof_admin access profile can change.
    • config vdom contains each VDOM and its respective settings.

    This menu and CLI structure change is not visible to non-global accounts; VDOM administrators’ navigation menus continue to appear similar to when VDOMs are disabled, except that global settings such as network interfaces, HA, and other global settings do not appear.

  • Continue by defining VDOMs.
  • Creating VDOMs

    Some settings can only be configured by the admin account — they are global. Global settings apply to the appliance overall regardless of VDOM, such as:

    • network interfaces
    • system time
    • backups
    • administrator accounts
    • access profiles
    • FortiGuard connectivity settings
    • HA and configuration sync
    • SNMP
    • X.509 certificates
    • TCP SYN flood anti-DoS setting
    • exec ping and other global operations that exist only in the CLI

    Only the admin account can configure global settings.

    Other settings can be configured separately for each VDOM. They essentially define each VDOM. For example, the policies of VDOM-A are separate from VDOM-B.

    Initially, only the root VDOM exists, and it contains settings such as policies that were global before VDOMs were enabled. Typically, you will create additional VDOMs, and few if any administrators will be assigned to the root VDOM. After VDOMs are created, the admin account usually assigns other administrator accounts to configure their VDOM-specific settings. However, as the root account, the admin administrator does have permission to configure all settings, including those within VDOMs.

    To create a VDOM:
    1. Log in with the admin account.
    2. Other administrators do not have permissions to configure VDOMs.

    3. Enter the following commands:

    config vdom

    edit <VDOM_name>

    where <VDOM_name> is the name of your new VDOM. (Alternatively, to configure the default root VDOM, type root.

    The new VDOM exists, but its settings are not yet configured.

    Editing a VDOM

    You can modify the dynamic and static parameters of each VDOM by following the instructions below. Dynamic parameters determine how much of a dynamic resource, such as connections per second, a VDOM can use. Static parameters determine how much of a static resource, such as real servers, a VDOM can use.

    To edit a VDOM:

    1. Enable vdom

    2. Execute the following commands. A value of 0 means the parameter has no limit.

    config global

    config system vdom

    edit <VDOM_name>

    L4CPS : 0

    L7CPS : 0

    L7RPS : 0

    SSLCPS : 0

    SSLTHROUGHPUT : 0

    CONCURRENTSESSION : 0

    virtualserver : 0

    realserver : 0

    healthcheck : 0

    sourcepool : 0

    errorpage : 0

    localuser : 0

    usergroup : 0

    INBOUND : 0

    OUTBOUND : 0

    Dynamic parameters

    L4CPS

    The number of layer 4 connections created per second. When the creation speed exceeds this value, only this number of connections will be created per second. The rest will be dropped.

    L7CPS

    The number of layer 7 TCP connections created by the httproxy frontend per second. When the creation speed exceeds this value, only this number of connections will be created per second. Additional TCP syn requests will be dropped on the client side.

    L7RPS

    The number of HTTP GET requests handled by the httproxy from the client side per second. When the number of requests per second exceeds this value, only this number of requests will be handled. Additional HTTP GET requests will be dropped.

    SSLCPS

    The number of SSL connections created by the httproxy frontend per second. When the creation speed of new SSL connections exceeds this value, only this number of connections will be created per second. Additional connections will not be allowed and additional syn packets will be dropped during that second.

    SSLTHROUGHPUT

    The volume of SSL encrypted TCP traffic from both the incoming and outgoing side. When the traffic throughput exceeds this value, additional packets from the client will be dropped and new connections will not be allowed.

    CONCURRENTSESSION

    The total number of living connections for ADC traffic. Living connections include L4, L7, and L7 SSL. When the number of living connections exceeds this number, additional connections will not be allowed.

    INBOUND

    The maximum volume of inbound traffic allowed. Only L4 and L7 SLB TCP traffic will be counted.

    OUTBOUND

    The maximum volume of outbound traffic allowed. Only L4 and L7 SLB TCP traffic will be counted.

    Static parameters

    virtualserver

    The maximum number of virtual servers that can be configured using "config load-balance virtual-server" in the chosen VDOM.

    realserver

    The maximum number of real servers that can be configured using "config load-balance real-server" in the chosen VDOM.

    healthcheck

    The maximum number of healthcheck members that can be configured using "config system health-check" in the chosen VDOM.

    sourcepool

    The maximum number of IP pools that can be configured using "config load-balance ippool" in the chosen VDOM.

    errorpage

    The maximum number of error page files that can be configured using "config load-balance error-page" in the chosen VDOM.

    localuser

    The maximum number of local users that can be configured using "config user local" in the chosen VDOM.

    usergroup

    The maximum number of user groups that can be configured using "config user user-group" in the chosen VDOM.

    Assigning interfaces to a VDOM

    The following commands assign a network interface to a VDOM:

    FortiADC-VM # config global

    FortiADC-VM (global) # config system interface

    FortiADC-VM (interface) # edit port10

    FortiADC-VM (port10) # set vdom docs-vdom

    FortiADC-VM (port10) # end

    Changing interface(port10) vdom from root(1) to docs-vdom(233):

    change vdom success.

    Assigning administrators to a VDOM

    The following commands create an administrator account and assign the administrator to a vdom:

    FortiADC-VM # config global

    FortiADC-VM (global) # config system admin

    FortiADC-VM (admin) # edit docs-vdom-admin

    Add new entry 'docs-vdom-admin' for node 78

    FortiADC-VM (docs-vdom-admin) # set access-profile admin_prof

    FortiADC-VM (docs-vdom-admin) # set vdom docs-vdom

    FortiADC-VM (docs-vdom-admin) # end

    Disabling VDOMs

    Before you begin:

    • Save a backup of the configuration. Disabling VDOMs changes the structure of your configuration, and deletes most VDOM-related settings. It keeps settings from the root VDOM only.
    To disable VDOMs
    1. Assign interfaces to the root VDOM. For example:
    2. FortiADC-VM # config global

      FortiADC-VM (global) # config system interface

      FortiADC-VM (interface) # edit port10

      FortiADC-VM (port10) # set vdom root

      FortiADC-VM (port10) # end

      Changing interface(port10) vdom from docs-vdom(233) to root(1):

      change vdom success.

    3. Assign admin accounts to the root VDOM or delete them. For example:
    4. FortiADC-VM (global) # config system admin

      FortiADC-VM (admin) # delete docs-vdom-admin

      FortiADC-VM (admin) # end

    5. Delete non-root VDOMs:
    6. FortiADC-VM # config vdom

      FortiADC-VM (vdom) # delete docs-vdom

      FortiADC-VM (vdom) # end

    7. Disable VDOMs:

    FortiADC-VM # config global

    FortiADC-VM (global) # config system global

    FortiADC-VM (global) # set vdom-admin disable

    FortiADC-VM (global) # end

    The system disables VDOMs and terminates your administrative session.

    Viewing VDOMs

    Use the following command to show the usage and settings for all VDOMS on the system:

    get system vdom-status

    The following example shows the system with two VDOMs set.

    FortiADC-300D # get system vdom-status

    root:

    l4cps: 4.87/-

    l7cps: 90.2/-

    l7rps: 0.0/-

    SSLcps: 3.7/-

    SSLThroughput(KB/S): 1550.0/-

    ConcurrentSession: 47.0/-

    Inbound(KB/S): 255.6/-

    Outbound(KB/S): 104669.0/-

    VirtualServer: 21/-

    RealServer: 33/33

    Health Check: 5/-

    Source Pool: 0/-

    Error-Page: 1/-

    LocalUser: 0/-

    UserGroup: 2/-

    vdom1:

    l4cps: 0.0/-

    l7cps: 0.0/-

    l7rps: 0.0/-

    SSLcps: 0.0/-

    SSLThroughput(KB/S): 0.0/-

    ConcurrentSession: 0.0/-

    Inbound(KB/S): 0.0/-

    Outbound(KB/S): 0.0/-

    VirtualServer: 0/-

    RealServer: 0/-

    Health Check: 4/-

    Source Pool: 0/-

    Error-Page: 0/-

    LocalUser: 0/-

    UserGroup: 0/-

    The first number represents the current usage. The second number represents the limit set. A dashed line means no limit has been set.