Inter-VDOM Routing Configuration
A FortiGate administrator needs to configure a policy that allows traffic from VDOM A to VDOM B using inter-VDOM routing. Which configuration is required?
Quick Answer
The correct answer is that policies must be configured in both VDOMs to allow traffic to and from the inter-VDOM link. This is required because inter-VDOM routing operates as a logical point-to-point connection between VDOMs, and FortiGate enforces stateful inspection at each VDOM boundary—meaning traffic leaving VDOM A must be permitted by a policy there, and the returning or forwarded traffic entering VDOM B must be explicitly allowed by a separate policy in VDOM B. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding that inter-VDOM routing is not a trust relationship; a common trap is assuming a single policy in one VDOM suffices for bidirectional traffic. Remember the memory tip: “Two VDOMs, two policies—one for the outbound, one for the inbound.”
⚠ Common exam trap
Test-takers frequently assume a single policy in the source VDOM is sufficient, forgetting that FortiGate treats each VDOM as a separate virtual firewall requiring its own policy for return traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policies in both VDOMs allowing traffic to and from the inter-VDOM link
Inter-VDOM routing requires explicit policy enforcement on both sides of the inter-VDOM link. A single policy in VDOM A cannot control return traffic from VDOM B, and FortiGate does not implicitly allow traffic between VDOMs. Therefore, policies must be configured in both VDOMs to permit traffic in both directions, ensuring stateful inspection and security controls are applied consistently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A single policy in VDOM A with destination VDOM B
Why it's wrong here
A policy in VDOM B is also needed for return traffic.
- ✗
A static route in VDOM A pointing to VDOM B
Why it's wrong here
Static routes may be needed, but the primary requirement is firewall policies.
- ✓
Policies in both VDOMs allowing traffic to and from the inter-VDOM link
Why this is correct
Correct: policies in both VDOMs are required to allow bidirectional traffic.
- ✗
Disable VDOM security features
Why it's wrong here
Disabling security is not required.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured with multiple VDOMs. The administrator needs to allow traffic from a VDOM named 'CustomerA' to reach a server in VDOM 'SharedServices'. Both VDOMs are on the same FortiGate. Which configuration is necessary?
medium- A.Place both VDOMs in the same ADOM in FortiManager
- ✓ B.Enable inter-VDOM routing and create policies allowing traffic between the VDOMs
- C.Create a VDOM link between the two VDOMs
- D.Configure the FortiGate in transparent mode
Why B: Inter-VDOM routing is required to route traffic between VDOMs on the same FortiGate. This is enabled globally via the CLI command 'config system global' and 'set inter-vdom-routing enable'. Once enabled, you must create firewall policies between the VDOMs (using the VDOM link or directly referencing the VDOMs in policies) to permit the traffic. Without inter-VDOM routing, VDOMs are isolated Layer 3 domains and cannot communicate.
Variation 2. An enterprise FortiGate has multiple VDOMs. The administrator wants to allow traffic from VDOM A to reach servers in VDOM B without traversing an external router. Which configuration is required?
medium- A.Place both VDOMs in the same VDOM group
- B.Configure a static route in each VDOM pointing to the other VDOM's management IP
- ✓ C.Create an inter-VDOM link using the 'config system interface' command with type 'vdom-link'
- D.Enable VDOM forwarding in global settings
Why C: Inter-VDOM links are the native FortiGate mechanism for routing traffic between VDOMs without external hardware. Created via 'config system interface' with type 'vdom-link', they act as a direct Layer 3 connection between VDOMs, allowing traffic to flow internally through the FortiGate's backplane. This avoids the need for an external router or physical cabling.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.