NSE7 Enterprise Firewall and VDOMs Practice Question
In a multi-VDOM deployment, inter-VDOM routing is configured using VDOM links. After configuring the VDOM links and adding static routes, traffic between VDOMs is not working. The administrator verifies that the VDOM link interfaces are up and have correct IP addresses. What is the most likely missing configuration?
⚠ Common exam trap
Candidates often assume VDOM links bypass firewall policies because they are internal virtual connections, but FortiGate treats all inter-VDOM traffic as requiring explicit policy approval, unlike a simple router-on-a-stick design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Firewall policies are missing or not allowing the traffic
In a FortiGate multi-VDOM deployment, VDOM links create a direct Layer 3 connection between VDOMs, but traffic is still subject to firewall policies. Even with correct IP addresses and static routes, inter-VDOM traffic will be dropped unless explicit firewall policies are configured on both VDOMs to permit the traffic. This is because FortiGate enforces stateful inspection at every VDOM boundary, including VDOM links.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The inter-VDOM routing mode is set to 'nat' instead of 'route'
Why it's wrong here
Inter-VDOM link mode 'nat' still forwards traffic between VDOMs; it applies source NAT rather than blocking routing, so static routes would still function. It is tempting because NAT mode is a legitimate inter-VDOM link setting used when VDOMs share overlapping address space, which is not the scenario here.
- ✗
The VDOM links are not assigned to the correct VDOM
Why it's wrong here
If a VDOM link interface were bound to the wrong VDOM, its IP address would not appear in the intended VDOM's routing table, so the static routes would fail to resolve — but the stem states interfaces are up with correct addresses, which already confirms correct VDOM assignment. Assigning links to VDOMs is the genuine step when initially creating the link pair.
- ✓
Firewall policies are missing or not allowing the traffic
Why this is correct
Even with VDOM link interfaces up and static routes present, inter-VDOM traffic is still subject to security policy evaluation. Each VDOM maintains its own policy set, so rules permitting traffic from the source zone to the destination zone across the VDOM link must exist and match, otherwise sessions are dropped.
- ✗
The VDOMs are in different administrative domains
Why it's wrong here
Administrative domains govern management access separation, not packet forwarding between VDOMs; VDOM links carry traffic regardless of which administrator domain each VDOM belongs to. It is tempting because domain membership does restrict cross-VDOM visibility in multi-tenant setups, and would matter if the requirement were isolating management rather than routing traffic.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.