Inter-VDOM Traffic Inspection Requirements
An administrator wants to ensure that traffic between two VDOMs on the same FortiGate is properly inspected. Which THREE configurations must be in place?
Quick Answer
The answer is that an inter-VDOM link between the VDOMs must be created, and inspection profiles must be explicitly applied to the firewall policies governing that link. This is correct because inter-VDOM traffic on a FortiGate is routed through a logical inter-VDOM link, which acts as a virtual interface pair; without applying UTM profiles—such as antivirus, web filtering, and IPS—to the policies on that link, the device forwards packets based solely on the accept/deny action, bypassing all deep packet inspection. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of how multi-VDOM architectures enforce security boundaries, and a common trap is assuming that default inspection is applied automatically to inter-VDOM traffic—it is not. Remember the memory tip: “Link first, then inspect—no profile, no protection.”
⚠ Common exam trap
Watch out — candidates often assume SSL inspection must be enabled on the inter-VDOM link interface itself, but FortiGate requires SSL inspection to be configured as part of the inspection profile applied to the firewall policy, not on the interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inspection profiles applied to the policies
Option D is correct because an inter-VDOM link is the virtual interface pair that provides the actual data path between two VDOMs on the same FortiGate; without it, no traffic can pass between the VDOMs. Option C is correct because each VDOM requires its own firewall policy that permits traffic to traverse the inter-VDOM link, since policies are evaluated per-VDOM and a policy in one VDOM does not automatically apply to the other. Option A is correct because inspection profiles (such as antivirus, IPS, web filter, or application control) must be attached to those inter-VDOM policies for the traffic to actually be inspected rather than merely permitted. Option B is not required because SSL inspection is a profile-level setting applied through a firewall policy, not a property enabled on the inter-VDOM link interface itself. Option E is not required because the inter-VDOM link is directly connected and its subnets are known to each VDOM, so static routes pointing to the link are unnecessary for basic inter-VDOM traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Inspection profiles applied to the policies
Why this is correct
Security profiles must be attached to the inter-VDOM firewall policies, since inspection only occurs where a policy references the relevant profile. Without this binding, traffic crossing the link is permitted but not scanned, so the inspection requirement in the stem is unmet.
- ✗
Enable SSL inspection on the inter-VDOM link interface
Why it's wrong here
SSL inspection decrypts TLS traffic; it is not required for inter-VDOM traffic to be inspected at all. It is tempting because inspection is associated with security profiles, and would be correct where the requirement is to examine encrypted sessions, not merely to route traffic between VDOMs.
- ✓
A firewall policy in each VDOM permitting traffic across the link
Why this is correct
Each VDOM maintains its own independent policy set, so traffic leaving VDOM_A and entering VDOM_B must be permitted by policies in both VDOMs. A single policy cannot span the inter-VDOM link, leaving one direction blocked.
- ✓
An inter-VDOM link between the VDOMs
Why this is correct
An inter-VDOM link provides the dedicated virtual interface pair connecting the two VDOMs, carrying traffic between them so the firewall can apply policy and inspection. Without this link, no path exists between the VDOMs, so the required traffic inspection between them cannot occur.
- ✗
Static routes on both VDOMs pointing to the inter-VDOM link
Why it's wrong here
Static routes pointing to the inter-VDOM link are not among the three required configurations; the link itself provides the path. It is tempting because routing between VDOMs feels necessary, and would be correct in designs using separate physical interfaces instead of an inter-VDOM link.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator is troubleshooting a scenario where traffic between two VDOMs is not working. The admin has configured inter-VDOM routing. Which TWO steps should the administrator verify? (Choose two.)
medium- A.Check that NAT is enabled on the policies
- ✓ B.Check that there is a firewall policy in the destination VDOM allowing the return traffic
- C.Check that the inter-VDOM link is configured as a physical interface
- ✓ D.Check that there is a firewall policy in the source VDOM allowing traffic to the destination VDOM
- E.Check that both VDOMs are in the same administrative VDOM
Why B: Inter-VDOM routing requires firewall policies in both the source and destination VDOMs to permit traffic. The destination VDOM must have a policy allowing the return traffic (from the destination to the source) for the session to be established. Without this, the FortiGate will drop the return packets, breaking the bidirectional flow.
Variation 2. A FortiGate administrator is troubleshooting a scenario where users in VDOM-1 cannot reach a server in VDOM-2. Inter-VDOM routing is configured using a VDOM link. The administrator checks the session table and sees that packets are arriving on the VDOM link interface but are not being forwarded. What is the MOST likely cause?
hard- A.The VDOM link is in the wrong VDOM
- ✓ B.A firewall policy is blocking the traffic from the VDOM link to the destination
- C.The routing table in VDOM-1 does not have a default route
- D.The VDOM link is not administratively up
Why B: When packets arrive on the VDOM link interface but are not forwarded, the issue is typically a missing or misconfigured firewall policy in the destination VDOM (VDOM-2). Even though inter-VDOM routing is correctly set up via the VDOM link, FortiGate requires an explicit firewall policy in the destination VDOM to permit traffic from the VDOM link interface to the destination server. Without this policy, the FortiGate drops the packets after routing, which matches the symptom of packets arriving but not being forwarded.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.