NSE4 Firewall Policies and NAT Practice Question
A FortiGate has multiple VDOMs. The administrator needs to allow traffic from VDOM A (port1) to VDOM B (port2). What type of firewall policy is required?
⚠ Common exam trap
Test-takers frequently assume a regular intra-VDOM policy with a cross-VDOM destination interface will work, but FortiGate enforces strict VDOM isolation and requires the explicit inter-VDOM link and policy to route traffic between VDOMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An inter-VDOM policy on the inter-VDOM link interface
When traffic must cross from one VDOM to another on a FortiGate, an inter-VDOM policy is required. This policy is applied to the inter-VDOM link interface, which acts as the logical boundary between VDOMs. It allows the firewall to enforce separate routing and security contexts while forwarding traffic between VDOMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An inter-VDOM policy on the inter-VDOM link interface
Why this is correct
An inter-VDOM link provides a virtual connection between two VDOMs, and traffic crossing that link is controlled by an inter-VDOM policy. This policy is configured on the inter-VDOM link interface and functions as a firewall rule that specifies permitted source/destination addresses and services between the VDOMs. Without this policy, the inter-VDOM link will deny all traffic by default, so it is the essential configuration element for inter-VDOM communication.
- ✗
A policy using a virtual wire pair
Why it's wrong here
A virtual wire pair is a transparent-mode feature that pairs two ports and simply forwards traffic between them based on a virtual wire policy, with no Layer 3 routing or NAT involved. It does not create a VDOM boundary; both ports in the pair belong to the same VDOM, and the pair itself operates as a L2 pass-through, not as a routed connection between separate VDOMs. Therefore it cannot enable inter-VDOM traffic in the administrator's multi-VDOM scenario.
- ✗
A regular intra-VDOM policy on VDOM A with destination interface port2
Why it's wrong here
A regular intra-VDOM policy in VDOM A cannot use port2 as a destination interface because port2 belongs to a different VDOM; each VDOM has its own isolated interface namespace and routing table. FortiGate policies are always evaluated within a single VDOM, so an interface from another VDOM is not even visible in the policy editor. The only way to direct traffic to port2 is to first route it through an inter-VDOM link connecting the two VDOMs.
- ✗
A policy on each VDOM with the same source/destination
Why it's wrong here
Creating a policy on each VDOM with the same source and destination addresses does not establish a path for traffic to cross the VDOM boundary; VDOMs are isolated at the data plane, and inter-VDOM traffic is never implicitly routed. Policies in different VDOMs are independent and cannot 'match' each other; without a physical or logical inter-VDOM link (and its associated policy), the traffic will simply be dropped at the VDOM edge. A visible inter-VDOM link is required to give the routing engine a route from one VDOM to the other.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.