@takodotid/circuit 0.38.0 → 0.40.0

package/src/helpers/upstreams.ts

@@ -32,6 +32,8 @@ export type Upstream = {
         vlan: number;
         /** It sends its VLAN tagged: its port gets a native VLAN of its own with this ID, which nothing else is in. Untagged when absent. */
         native?: number;
+        /** Its number in names with `{number}`, such as `core-ipt01-transita`. Written here, so removing another upstream renumbers nothing. */
+        number?: number;
         /** Our addresses on it. `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
         addresses: readonly (InterfaceAddress | { address: InterfaceAddress; peer: IP })[];
         /** The switch port it arrives on. */
@@ -39,8 +41,8 @@ export type Upstream = {
         /** An exchange's LAN, for `circuit peeringdb`. */
         exchange?: ExchangeLan;
     };
-    /** A GRE tunnel to it. */
-    tunnel?: { local: IP; remote: IP; addresses: readonly InterfaceAddress[]; mtu?: number };
+    /** A GRE tunnel to it. `number` is its number in names with `{number}`. */
+    tunnel?: { local: IP; remote: IP; addresses: readonly InterfaceAddress[]; mtu?: number; number?: number };
     /** Our BGP sessions with it, by name: its address, and ours when it is not the interface's. */
     sessions: Readonly<Record<string, { address: IP; local_address?: IP }>>;
     /** The sessions are more than one hop away, from this address of ours. They share a group. */
@@ -65,6 +67,29 @@ export type Upstream = {
 /** Upstreams by key. The key names everything built from it. */
 export type UpstreamCatalog = Readonly<Record<string, Upstream>>;
 
+/** A name made from an upstream: `{key}` is its key, `{KEY}` the key in capitals, `{number}` its `handoff.number` or `tunnel.number`. */
+type Pattern = string;
+/** A pattern for every upstream, or one per role. A role left out takes the default. */
+type ByRole = Pattern | { readonly provider?: Pattern; readonly rs?: Pattern; readonly peer?: Pattern };
+
+/** How the names built from each upstream are made. Each one left out takes its default. */
+export type UpstreamNames = {
+    /** The VLAN a handoff is on. `{key}` when absent. */
+    vlan?: ByRole;
+    /** The native VLAN of a handoff sent tagged. `{key}-native` when absent. */
+    native?: Pattern;
+    /** The router's interface: per role, and `tunnel` for one reached over a tunnel. `{key}` when absent. */
+    interface?: Pattern | { readonly provider?: Pattern; readonly rs?: Pattern; readonly peer?: Pattern; readonly tunnel?: Pattern };
+    /** The import policy. `{KEY}-IN` when absent. */
+    import?: Pattern;
+    /** The export policy. `{KEY}-OUT` when absent. */
+    export?: Pattern;
+    /** The BGP group of an exchange's route servers or of multihop sessions. `{key}` when absent. */
+    group?: Pattern;
+    /** The description of a handoff's switch port. Its `name` when absent. No device names it, so it may be any function. */
+    port?: (key: string, upstream: Upstream) => string;
+};
+
 /** How each upstream's policies are written: shared by every upstream of a catalog. */
 export type UpstreamPolicies<P extends string> = {
     /** A policy holding `Bgp.sanity()` that each import calls. The sanity rules are written in each import when absent. */
@@ -77,6 +102,19 @@ export type UpstreamPolicies<P extends string> = {
     sources?: readonly IP[];
 };
 
+/** The names a device can refer to, and their patterns when the project gives none. */
+const DEFAULTS = {
+    vlan: "{key}",
+    native: "{key}-native",
+    interface: "{key}",
+    import: "{KEY}-IN",
+    export: "{KEY}-OUT",
+    group: "{key}",
+} as const;
+
+type Defaults = typeof DEFAULTS;
+type Field = keyof Defaults;
+
 type Key<C> = keyof C & string;
 /** The upstreams that land on a VLAN of ours. */
 type Landed<C> = { [K in Key<C>]: C[K] extends { handoff: object } ? K : never }[Key<C>];
@@ -89,35 +127,123 @@ type Grouped<C> = { [K in Key<C>]: C[K] extends { role: "rs" } | { multihop: obj
 /** The upstreams we take routes from. */
 type Importing<C> = { [K in Key<C>]: C[K] extends { import: object } ? K : never }[Key<C>];
 
-/** A native VLAN's name. */
-type Native<K extends string> = `${K}-native`;
-/** Each upstream's policies: `TRANSIT_A-IN` and `TRANSIT_A-OUT`. */
-type PolicyName<C> = `${Uppercase<Importing<C>>}-IN` | `${Uppercase<Key<C>>}-OUT`;
+/** The project's pattern for a name, or the default. */
+type PatternOf<N, F extends Field> = N extends { [X in F]: infer P } ? P : Defaults[F];
+/** The pattern an upstream takes: the only one, its tunnel's, its role's, or the default. */
+type Chosen<P, U, F extends Field> = P extends string
+    ? P
+    : U extends { tunnel: object }
+      ? P extends { tunnel: infer T extends string }
+          ? T
+          : Defaults[F]
+      : U extends { role: infer R extends string }
+        ? P extends { [X in R]: infer T extends string }
+            ? T
+            : Defaults[F]
+        : Defaults[F];
+/** Every `From` in `S` replaced. */
+type Replace<S extends string, From extends string, To extends string> = S extends `${infer A}${From}${infer B}`
+    ? `${A}${To}${Replace<B, From, To>}`
+    : S;
+/** An upstream's `handoff.number` or `tunnel.number`. */
+type NumberOf<U> = U extends { handoff: { number: infer N extends number } }
+    ? N
+    : U extends { tunnel: { number: infer N extends number } }
+      ? N
+      : number;
+/** The name built for upstream `K`: its pattern with the key, the key in capitals and its number filled in. */
+type Named<C, N, F extends Field, K extends Key<C>> = Replace<
+    Replace<Replace<Chosen<PatternOf<N, F>, C[K], F>, "{key}", K>, "{KEY}", Uppercase<K>>,
+    "{number}",
+    `${NumberOf<C[K]>}`
+>;
+/** Each of these upstreams' names. */
+type Names<C, N, F extends Field, Ks extends Key<C>> = { [K in Ks]: Named<C, N, F, K> }[Ks];
 
 /** The catalog as written, with any key the shape does not have refused, at every level. */
-type Exact<S, T> = T extends readonly unknown[] | string | number | boolean | Secret
+type Exact<S, T> = T extends readonly unknown[] | string | number | boolean | Secret | ((...args: never[]) => unknown)
     ? T
-    : { [K in keyof T]: K extends keyof S ? Exact<NonNullable<S[K]>, T[K]> : never };
+    : // A shape that is a union, such as a storm-control threshold, is each of its members in turn: its keys are any member's.
+      S extends unknown
+      ? { [K in keyof T]: K extends keyof S ? Exact<NonNullable<S[K]>, T[K]> : never }
+      : never;
+
+/** The names as written, with a name or a role Upstreams does not make refused. */
+type ExactNames<N> = {
+    [F in keyof N]: F extends keyof UpstreamNames
+        ? N[F] extends string | ((...args: never[]) => unknown)
+            ? N[F]
+            : { [R in keyof N[F]]: R extends "provider" | "rs" | "peer" | "tunnel" ? N[F][R] : never }
+        : never;
+};
 
 /** A network's upstreams written once, and each device's part built from them. */
 export class Upstreams {
     /**
-     * Each upstream written once: its AS, where it lands, its sessions, limits and policy. Everything a device needs is built from it, under names made from each key, so a device that names one is checked:
+     * Each upstream written once: its AS, where it lands, its sessions, limits and policy. Everything a device needs is built from it, under names made from each key, so a device that names one is checked. By default:
      *
      * - VLAN `<key>`, and `<key>-native` for one that sends its VLAN tagged. The router's interface is `<key>` too, a VLAN interface or a GRE tunnel.
      * - Policies `<KEY>-IN` and `<KEY>-OUT`; a BGP group `<key>` for an exchange's route servers or multihop sessions.
      *
-     * On the router: `vlans()`, `interfaces()`, `groups()`, `neighbors()`, `policies({ ... })`, `tunnelRules()`, `addresses()`. On a switch: `vlans(device)`, `ports(device)`, `vlansOn(device)`. For checks and ACLs: `untrusted()`, `natives()`, `privateDrops()`. Lists follow the catalog's order, where order counts on a device.
+     * `names` gives patterns of your own, such as `{ interface: { provider: "core-ipt0{number}-{key}" } }`; see `UpstreamNames`.
+     *
+     * On the router: `vlans()`, `interfaces()`, `uplinks()`, `groups()`, `neighbors()`, `policies({ ... })`, `tunnelRules()`, `addresses()`. On a switch: `vlans(device)`, `ports(device)`, `vlansOn(device)`. For checks and ACLs: `untrusted()`, `natives()`, `privateDrops()`. Lists follow the catalog's order, where order counts on a device.
      */
-    static define<const C extends UpstreamCatalog>(catalog: C & { [K in keyof C]: Exact<Upstream, C[K]> }) {
-        type V = Landed<C>;
-        type T = Tagged<C>;
-
+    static define<const C extends UpstreamCatalog, const N extends UpstreamNames = {}>(
+        catalog: C & { [K in keyof C]: Exact<Upstream, C[K]> },
+        options: { names?: N & ExactNames<N> } = {}
+    ) {
+        type V = Names<C, N, "vlan", Landed<C>>;
+        type T = Names<C, N, "native", Tagged<C>>;
+        type I = Names<C, N, "interface", Landed<C>>;
+        type G = Names<C, N, "interface", Tunneled<C>>;
+        type PolicyName = Names<C, N, "import", Importing<C>> | Names<C, N, "export", Key<C>>;
+        type Group = Names<C, N, "group", Grouped<C>>;
+
+        const names: UpstreamNames = options.names ?? {};
         const all = Object.entries(catalog) as [Key<C>, Upstream][];
         const nameOf = (key: string, upstream: Upstream) => upstream.name ?? key;
-        const policy = (key: string) => key.toUpperCase();
         const grouped = (upstream: Upstream) => upstream.role === "rs" || Boolean(upstream.multihop);
 
+        /** The name built for one upstream: its pattern with the key, the key in capitals and its number filled in. */
+        const named = (field: Field, key: string, upstream: Upstream): string => {
+            const given = names[field];
+            const pattern =
+                given === undefined || typeof given === "string"
+                    ? (given ?? DEFAULTS[field])
+                    : ((upstream.tunnel && "tunnel" in given ? given.tunnel : given[upstream.role]) ?? DEFAULTS[field]);
+
+            return pattern
+                .replaceAll("{key}", key)
+                .replaceAll("{KEY}", key.toUpperCase())
+                .replaceAll("{number}", () => {
+                    const number = upstream.handoff?.number ?? upstream.tunnel?.number;
+                    if (number === undefined) throw new Error(`Upstreams: ${key} needs a number for ${field} name ${pattern}`);
+                    return String(number);
+                });
+        };
+
+        // Two upstreams under one name would replace each other on the device.
+        for (const field of Object.keys(DEFAULTS) as Field[]) {
+            const taken = new Map<string, string>();
+
+            for (const [key, upstream] of all) {
+                if (field === "native" && upstream.handoff?.native === undefined) continue;
+                if (field === "import" && !upstream.import) continue;
+                if (field === "group" && !grouped(upstream)) continue;
+                if ((field === "vlan" && !upstream.handoff) || (field === "interface" && !upstream.handoff && !upstream.tunnel)) continue;
+
+                const name = named(field, key, upstream);
+                const other = taken.get(name);
+                if (other) throw new Error(`Upstreams: ${other} and ${key} both have the ${field} name ${name}`);
+                taken.set(name, key);
+            }
+        }
+
+        const vlan = (key: string, upstream: Upstream) => named("vlan", key, upstream) as V;
+        const native = (key: string, upstream: Upstream) => named("native", key, upstream) as T;
+        const policy = (direction: "import" | "export", key: string, upstream: Upstream) => named(direction, key, upstream) as PolicyName;
+
         /** Each landed upstream's VLAN; with a device, the VLANs and natives of those arriving on its ports. */
         const vlans = <const D extends string | undefined = undefined>(device?: D) => {
             const result: Record<string, Vlan> = {};
@@ -126,33 +252,33 @@ export class Upstreams {
                 const handoff = upstream.handoff;
                 if (!handoff || (device !== undefined && handoff.port?.device !== device)) continue;
 
-                result[key] = { id: handoff.vlan, description: nameOf(key, upstream) };
+                result[vlan(key, upstream)] = { id: handoff.vlan, description: nameOf(key, upstream) };
                 if (device !== undefined && handoff.native !== undefined) {
-                    result[`${key}-native`] = {
+                    result[native(key, upstream)] = {
                         id: handoff.native,
                         description: `Native toward ${nameOf(key, upstream)}, nothing else in it`,
                     };
                 }
             }
 
-            return result as D extends string ? { [K in V]: Vlan } & { [K in T as Native<K>]: Vlan } : { [K in V]: Vlan };
+            return result as D extends string ? { [K in V]: Vlan } & { [K in T]: Vlan } : { [K in V]: Vlan };
         };
 
         const vlansOn = (device: string) =>
-            all.filter(([, upstream]) => upstream.handoff?.port?.device === device).map(([key]) => key as V);
+            all.filter(([, upstream]) => upstream.handoff?.port?.device === device).map(([key, upstream]) => vlan(key, upstream));
 
         const ports = (device: string) => {
-            const result: Record<string, Port<V | Native<T>, never, never, never>> = {};
+            const result: Record<string, Port<V | T, never, never, never>> = {};
 
             for (const [key, upstream] of all) {
                 const handoff = upstream.handoff;
                 if (!handoff?.port || handoff.port.device !== device) continue;
 
                 result[handoff.port.port] = {
-                    description: nameOf(key, upstream),
+                    description: names.port ? names.port(key, upstream) : nameOf(key, upstream),
                     ...(handoff.native !== undefined
-                        ? { trunk_vlans: [key as V], native_vlan: `${key}-native` as Native<T> }
-                        : { access_vlan: key as V }),
+                        ? { trunk_vlans: [vlan(key, upstream)], native_vlan: native(key, upstream) }
+                        : { access_vlan: vlan(key, upstream) }),
                     lldp: false,
                     stp: false,
                     ...(handoff.port.storm_control ? { storm_control: handoff.port.storm_control } : {}),
@@ -167,26 +293,31 @@ export class Upstreams {
 
             for (const [key, upstream] of all) {
                 const description = nameOf(key, upstream);
+                const name = named("interface", key, upstream);
 
                 if (upstream.tunnel) {
                     const { local, remote, addresses, mtu } = upstream.tunnel;
-                    result[key] = { type: "gre", description, local, remote, addresses, ...(mtu ? { mtu } : {}) };
+                    result[name] = { type: "gre", description, local, remote, addresses, ...(mtu ? { mtu } : {}) };
                 } else if (upstream.handoff) {
                     const { addresses, exchange } = upstream.handoff;
-                    result[key] = { type: "vlan", vlan: key as V, description, addresses, ...(exchange ? { exchange } : {}) };
+                    result[name] = { type: "vlan", vlan: vlan(key, upstream), description, addresses, ...(exchange ? { exchange } : {}) };
                 }
             }
 
-            return result as { [K in V]: VlanInterface<V, never> } & { [K in Tunneled<C>]: Gre<never> };
+            return result as { [K in I]: VlanInterface<V, never> } & { [K in G]: Gre<never> };
         };
 
+        /** The router's interfaces toward the internet: every landed upstream's, for NAT and lists like it. */
+        const uplinks = () =>
+            all.filter(([, upstream]) => upstream.handoff).map(([key, upstream]) => named("interface", key, upstream) as I);
+
         /** What a session or its group takes from its upstream. */
-        const settings = (key: string, upstream: Upstream): NeighborSettings<PolicyName<C>> => ({
+        const settings = (key: string, upstream: Upstream): NeighborSettings<PolicyName> => ({
             remote_as: upstream.asn,
             description: nameOf(key, upstream),
             role: upstream.role,
-            ...(upstream.import ? { import: `${policy(key)}-IN` as PolicyName<C> } : {}),
-            export: `${policy(key)}-OUT` as PolicyName<C>,
+            ...(upstream.import ? { import: policy("import", key, upstream) } : {}),
+            export: policy("export", key, upstream),
         });
 
         const groups = () =>
@@ -196,7 +327,7 @@ export class Upstreams {
                     .map(([key, upstream]) => {
                         const multihop = upstream.multihop;
                         return [
-                            key,
+                            named("group", key, upstream),
                             {
                                 ...settings(key, upstream),
                                 ...(multihop
@@ -210,7 +341,7 @@ export class Upstreams {
                             },
                         ];
                     })
-            ) as Record<Grouped<C>, NeighborSettings<PolicyName<C>>>;
+            ) as Record<Group, NeighborSettings<PolicyName>>;
 
         const neighbors = () =>
             Object.fromEntries(
@@ -221,19 +352,19 @@ export class Upstreams {
                             name,
                             {
                                 ...session,
-                                ...(grouped(upstream) ? { group: key } : settings(key, upstream)),
+                                ...(grouped(upstream) ? { group: named("group", key, upstream) } : settings(key, upstream)),
                                 ...(limit ? { max_prefixes: limit } : {}),
                             },
                         ];
                     })
                 )
-            ) as Record<string, Neighbor<PolicyName<C>, Grouped<C>>>;
+            ) as Record<string, Neighbor<PolicyName, Group>>;
 
         const policies = <const P extends string = never>(options: UpstreamPolicies<P> = {}) => {
             const result: Record<string, PolicyRule<P, never>[]> = {};
 
             for (const [key, upstream] of all) {
-                result[`${policy(key)}-OUT`] = [
+                result[policy("export", key, upstream)] = [
                     ...(options.actions?.(key, upstream) ?? []),
                     ...(upstream.export ?? []),
                     ...Bgp.announce(upstream.announce),
@@ -243,7 +374,7 @@ export class Upstreams {
                 if (!taken) continue;
 
                 const tag = options.tag?.(key, upstream);
-                result[`${policy(key)}-IN`] = [
+                result[policy("import", key, upstream)] = [
                     ...(taken.default
                         ? Bgp.defaultOnly({ ...taken.default, ...(options.sources ? { sources: options.sources } : {}) })
                         : []),
@@ -259,16 +390,20 @@ export class Upstreams {
                 ];
             }
 
-            return result as Record<PolicyName<C>, PolicyRule<P, never>[]>;
+            return result as Record<PolicyName, PolicyRule<P, never>[]>;
         };
 
         /** The VLANs straight off an upstream, natives included: `untrusted` for `Checks.trustBoundary`. */
-        const untrusted = () => [...all.filter(([, upstream]) => upstream.handoff).map(([key]) => key as V), ...natives()];
+        const untrusted = () => [
+            ...all.filter(([, upstream]) => upstream.handoff).map(([key, upstream]) => vlan(key, upstream)),
+            ...natives(),
+        ];
 
         const natives = () =>
-            all.filter(([, upstream]) => upstream.handoff?.native !== undefined).map(([key]) => `${key}-native` as Native<T>);
+            all.filter(([, upstream]) => upstream.handoff?.native !== undefined).map(([key, upstream]) => native(key, upstream));
 
-        const privateDrops = () => all.filter(([, upstream]) => upstream.handoff && upstream.drop_private).map(([key]) => key as V);
+        const privateDrops = () =>
+            all.filter(([, upstream]) => upstream.handoff && upstream.drop_private).map(([key, upstream]) => vlan(key, upstream));
 
         const tunnelRules = (): FilterRule<never, never>[] =>
             all.flatMap(([key, upstream]) =>
@@ -293,6 +428,7 @@ export class Upstreams {
             vlansOn,
             ports,
             interfaces,
+            uplinks,
             groups,
             neighbors,
             policies,

package/src/platforms/derive.ts

@@ -4,7 +4,8 @@ import { Address } from "../core/address";
 import type { Device } from "../schema";
 
 /** A feature a platform renders once proved on one of its devices. */
-export type ProvedFeature = "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter";
+export type ProvedFeature =
+    "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter" | "management-vdom";
 
 export class Derive {
     /** Each LAG's number: its own `id`, or its position among the device's LAGs. */
@@ -41,6 +42,7 @@ export class Derive {
         const has = (feature: ProvedFeature) => proved.includes(feature);
 
         if (routing?.bfd && !has("bfd-timers")) found.push(`routing.bfd, BFD timers are ${unproved}`);
+        if (device.vdoms && !has("management-vdom")) found.push(`vdoms, a management VDOM is ${unproved}`);
 
         for (const route of routing?.static ?? []) {
             if (route.bfd && !has("static-route-bfd"))

package/src/platforms/fortios/firewall.ts

@@ -155,6 +155,15 @@ export class FortiOsFirewall {
         );
     }
 
+    /** Who reaches the device's own services, alone: for a management VDOM, which routes no traffic of its own. */
+    static managementOnly(root: FortiOsBlock, device: Device): void {
+        const localIns = { ipv4: 0, ipv6: 0 };
+        const localInEntry = (family: Family) =>
+            root.block(family === "ipv4" ? "firewall local-in-policy" : "firewall local-in-policy6").entry(++localIns[family]);
+
+        FortiOsFirewall.management(localInEntry, new Objects(root, device), device);
+    }
+
     /** Packet filtering, who reaches the device, NAT and stateless ACLs. */
     static render(root: FortiOsBlock, device: Device): void {
         const fw = device.firewall;

package/src/platforms/fortios/index.ts

@@ -18,6 +18,7 @@ import { FortiOsPlan } from "./plan";
 import { FortiOsRender } from "./render";
 import { FortiOsRouting } from "./routing";
 import { FortiOsBlock, FortiOsTree } from "./tree";
+import { FortiOsVdoms } from "./vdoms";
 
 /** What a session reads and writes: an SSH shell, or anything else that streams the CLI. */
 export type Channel = {
@@ -194,6 +195,7 @@ export class FortiOs extends Platform {
 
         if (device.stp) found.push("stp, ports are routed");
         found.push(...FortiOs.transparentGaps(device));
+        found.push(...FortiOsVdoms.gaps(device));
 
         for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
             if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
@@ -224,7 +226,8 @@ export class FortiOs extends Platform {
             device,
             async (cli) => {
                 await FortiOs.checkVersion(cli, device);
-                return FortiOs.neighborsOf(await cli.run("diagnose lldprx neighbor details"), device);
+                const details = await FortiOs.inGlobal(cli, device, () => cli.run("diagnose lldprx neighbor details"));
+                return FortiOs.neighborsOf(details, device);
             },
             options
         );
@@ -259,7 +262,7 @@ export class FortiOs extends Platform {
     }
 
     plan(desired: string, current: string, options: ApplyOptions): Plan {
-        return FortiOsPlan.of(desired, current, options);
+        return FortiOsVdoms.plan(desired, current, (want, have) => FortiOsPlan.of(want, have, options));
     }
 
     async apply(device: Device, network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void> {
@@ -269,7 +272,7 @@ export class FortiOs extends Platform {
         const switched = changes.steps.some((step) => step.send.some((line) => line.startsWith("set opmode ")));
         if (!switched) return;
 
-        const again = FortiOsPlan.of(FortiOsRender.of(device), await this.read(device, network, options), options);
+        const again = this.plan(FortiOsRender.of(device), await this.read(device, network, options), options);
         if (!again.steps.length) return;
 
         console.log("  the operation mode changed; applying what it added on its own");
@@ -281,7 +284,8 @@ export class FortiOs extends Platform {
         await FortiOs.withCli(device, async (cli) => {
             await FortiOs.checkVersion(cli, device);
 
-            for (const line of FortiOs.fillLines(set, family, prefixes)) {
+            const lines = FortiOs.fillLines(set, family, prefixes);
+            for (const line of device.vdoms ? FortiOsVdoms.wrap({ kind: "vdom", vdom: FortiOsVdoms.ROOT }, lines) : lines) {
                 let answer = await cli.run(line);
                 if (FortiOsCli.QUESTION.test(cli.prompt) && line === "purge") answer = await cli.answer("y");
                 if (FortiOs.REFUSED.test(answer)) throw new Error(`${set}: ${line}\n    device said: ${answer.trim().slice(0, 300)}`);
@@ -433,8 +437,8 @@ export class FortiOs extends Platform {
         }
     }
 
-    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. */
-    private static async checkVersion(cli: FortiOsCli, device: Device): Promise<void> {
+    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. Gives what `get system status` printed. */
+    private static async checkVersion(cli: FortiOsCli, device: Device): Promise<string> {
         const status = await cli.run("get system status");
         const version = /^Version: \S+ v(\d+)\.(\d+)\.(\d+)/m.exec(status);
 
@@ -444,6 +448,21 @@ export class FortiOs extends Platform {
                 `${device.name} runs FortiOS ${version[1]}.${version[2]}.${version[3]}; this adapter renders for FortiOS ${FortiOs.SUPPORTED}`
             );
         }
+
+        return status;
+    }
+
+    /** Run `work` among the device's own settings: inside `config global` on a device with VDOMs, as it is on one without. */
+    private static async inGlobal<T>(cli: FortiOsCli, device: Device | boolean, work: () => Promise<T>): Promise<T> {
+        const multi = typeof device === "boolean" ? device : Boolean(device.vdoms);
+        if (!multi) return work();
+
+        await cli.run("config global");
+        try {
+            return await work();
+        } finally {
+            await FortiOs.leave(cli);
+        }
     }
 
     /** Secrets the device prints: a password or an SNMPv3 key as a cipher, a certificate's key encrypted, and the SNMP community in clear. None leave the read. */
@@ -470,13 +489,15 @@ export class FortiOs extends Platform {
 
     /** Every section Circuit manages, as the device holds it, credentials scrubbed. */
     private static async readConfig(cli: FortiOsCli, device: Device): Promise<string> {
-        await FortiOs.checkVersion(cli, device);
-
+        const status = await FortiOs.checkVersion(cli, device);
+        const show = (section: string) =>
+            cli.run(`${FortiOsRender.FULL.includes(section) ? "show full-configuration" : "show"} ${section}`, 120_000);
         const parts: string[] = [];
 
-        for (const section of FortiOsRender.SECTIONS) {
-            const show = FortiOsRender.FULL.includes(section) ? "show full-configuration" : "show";
-            parts.push(await cli.run(`${show} ${section}`, 120_000));
+        if (/^Virtual domain configuration: (multiple|split-task)/m.test(status)) {
+            parts.push(...(await FortiOs.readVdoms(cli, device, show)));
+        } else {
+            for (const section of FortiOsRender.SECTIONS) parts.push(await show(section));
         }
 
         const text = parts.join("\n");
@@ -485,16 +506,51 @@ export class FortiOs extends Platform {
         return FortiOs.scrub(FortiOsPlan.clean(text));
     }
 
+    /**
+     * A device in multi-VDOM mode, read where each section lives: the device's own under `config global`, the rest in `root`, and a management VDOM's sections named as the render names them. A VDOM that does not exist yet is not entered, since `edit` would make it.
+     */
+    private static async readVdoms(cli: FortiOsCli, device: Device, show: (section: string) => Promise<string>): Promise<string[]> {
+        const management = FortiOsVdoms.managementOf(device);
+        if (!management) throw new Error(`${device.name} runs several VDOMs and its config has no vdoms; write vdoms.management`);
+
+        const parts: string[] = [];
+        const inVdom = async (vdom: string, sections: readonly string[]) => {
+            await cli.run("config vdom");
+            await cli.run(`edit ${vdom}`);
+            try {
+                for (const section of sections) {
+                    const text = await show(section);
+                    parts.push(vdom === FortiOsVdoms.ROOT ? text : FortiOsVdoms.named(vdom, text));
+                }
+            } finally {
+                await FortiOs.leave(cli);
+            }
+        };
+
+        const listed = await FortiOs.inGlobal(cli, true, async () => {
+            for (const section of FortiOsRender.SECTIONS.filter((one) => FortiOsVdoms.GLOBAL.has(one))) parts.push(await show(section));
+            return FortiOsVdoms.listed(await cli.run("diagnose sys vd list"));
+        });
+
+        await inVdom(
+            FortiOsVdoms.ROOT,
+            FortiOsRender.SECTIONS.filter((one) => !FortiOsVdoms.GLOBAL.has(one))
+        );
+        if (listed.includes(management)) await inVdom(management, FortiOsVdoms.MANAGEMENT_SECTIONS);
+
+        return parts;
+    }
+
     /** Leave every `config` and `edit` level, back to the top prompt. */
     private static async leave(cli: FortiOsCli): Promise<void> {
         for (let level = 0; level < 10 && /\(.*\) [#$] $/.test(cli.prompt); level++) await cli.run("end");
     }
 
     /** Send the lines that set how the device saves changes. */
-    private static async saving(cli: FortiOsCli, mode: "revert" | "automatic", seconds?: number): Promise<void> {
+    private static async saving(cli: FortiOsCli, mode: "revert" | "automatic", multi: boolean, seconds?: number): Promise<void> {
         const lines = ["config system global", `set cfg-save ${mode}`, ...(seconds ? [`set cfg-revert-timeout ${seconds}`] : []), "end"];
 
-        for (const line of lines) {
+        for (const line of multi ? FortiOsVdoms.wrap({ kind: "global" }, lines) : lines) {
             const answer = await cli.run(line);
             if (FortiOs.REFUSED.test(answer)) throw new Error(`the device refused ${line}: ${answer.trim().slice(0, 300)}`);
         }
@@ -503,14 +559,14 @@ export class FortiOs extends Platform {
     /**
      * Send a plan line by line, each applied as it arrives. The device is first set to revert what is not saved, so a refused line or a fresh login that fails reloads its saved configuration. Once access is proved the change is saved, and changes save themselves again.
      */
-    private static async configure(cli: FortiOsCli, plan: Plan, guard: Guard): Promise<void> {
+    private static async configure(cli: FortiOsCli, plan: Plan, guard: Guard, multi: boolean): Promise<void> {
         const minutes = guard.seconds / 60;
-        await FortiOs.saving(cli, "revert", guard.seconds);
+        await FortiOs.saving(cli, "revert", multi, guard.seconds);
 
         // The session still open reloads the saved configuration at once; if it cannot, the device does when the time runs out.
         const restore = async (reason: string) => {
             await FortiOs.leave(cli).catch(() => undefined);
-            await cli.run("execute cfg reload").catch(() => undefined);
+            await FortiOs.inGlobal(cli, multi, () => cli.run("execute cfg reload")).catch(() => undefined);
             return new Reloaded(
                 `${reason}\n    the device reloads its saved configuration, which undoes what was sent, at the latest in ${minutes} minutes`
             );
@@ -545,14 +601,14 @@ export class FortiOs extends Platform {
             throw await restore(`a fresh login failed: ${(error as Error).message}`);
         }
 
-        const saved = await cli.run("execute cfg save", 120_000);
+        const saved = await FortiOs.inGlobal(cli, multi, () => cli.run("execute cfg save", 120_000));
         if (!/config saved|no config to be saved/.test(saved)) {
             throw new Error(
                 `access was proved but the save failed; the device reverts in ${minutes} minutes:\n    ${saved.trim().slice(0, 300)}`
             );
         }
 
-        await FortiOs.saving(cli, "automatic");
+        await FortiOs.saving(cli, "automatic", multi);
         console.log("  logged in again, saved");
     }
 
@@ -566,8 +622,9 @@ export class FortiOs extends Platform {
             const settled = await FortiOs.withCli(
                 device,
                 async (cli) => {
-                    if (!/no config to be reloaded/.test(await cli.run("execute cfg reload"))) return false;
-                    await FortiOs.saving(cli, "automatic");
+                    const reloaded = await FortiOs.inGlobal(cli, device, () => cli.run("execute cfg reload"));
+                    if (!/no config to be reloaded/.test(reloaded)) return false;
+                    await FortiOs.saving(cli, "automatic", Boolean(device.vdoms));
                     return true;
                 },
                 options
@@ -575,7 +632,7 @@ export class FortiOs extends Platform {
             if (settled) return "the device is back and saves changes on its own again";
         }
 
-        return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global`";
+        return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global` (in `config global` on a device with VDOMs)";
     }
 
     private static async applyOnce(device: Device, plan: Plan, options: ApplyOptions): Promise<void> {
@@ -586,7 +643,7 @@ export class FortiOs extends Platform {
             if (options.console) {
                 await FortiOs.consoleSession(device, async (cli, relogin) => {
                     await FortiOs.checkVersion(cli, device);
-                    await FortiOs.configure(cli, plan, { seconds, prove: relogin });
+                    await FortiOs.configure(cli, plan, { seconds, prove: relogin }, Boolean(device.vdoms));
                 });
                 return;
             }
@@ -594,13 +651,18 @@ export class FortiOs extends Platform {
             await FortiOs.withCli(device, async (cli) => {
                 await FortiOs.checkVersion(cli, device);
 
-                await FortiOs.configure(cli, plan, {
-                    seconds,
-                    prove: async () => {
-                        const proof = await FortiOs.login(device);
-                        proof.end();
+                await FortiOs.configure(
+                    cli,
+                    plan,
+                    {
+                        seconds,
+                        prove: async () => {
+                            const proof = await FortiOs.login(device);
+                            proof.end();
+                        },
                     },
-                });
+                    Boolean(device.vdoms)
+                );
             });
         } catch (error) {
             if (!(error instanceof Reloaded)) throw error;