NSE7 Enterprise Firewall and VDOMs Practice Question
In a multi-VDOM deployment, inter-VDOM routing is configured using VDOM links. After configuring the VDOM links and adding static routes, traffic between VDOMs is not working. The administrator verifies that the VDOM link interfaces are up and have correct IP addresses. What is the most likely missing configuration?
⚠ Common exam trap
Candidates often assume VDOM links bypass firewall policies because they are internal virtual connections, but FortiGate treats all inter-VDOM traffic as requiring explicit policy approval, unlike a simple router-on-a-stick design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Firewall policies are missing or not allowing the traffic
In a FortiGate multi-VDOM deployment, VDOM links create a direct Layer 3 connection between VDOMs, but traffic is still subject to firewall policies. Even with correct IP addresses and static routes, inter-VDOM traffic will be dropped unless explicit firewall policies are configured on both VDOMs to permit the traffic. This is because FortiGate enforces stateful inspection at every VDOM boundary, including VDOM links.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The inter-VDOM routing mode is set to 'nat' instead of 'route'
Why it's wrong here
Inter-VDOM routing mode is not a setting; VDOM links operate in routed mode.
- ✗
The VDOM links are not assigned to the correct VDOM
Why it's wrong here
If interfaces are up, they are likely assigned correctly.
- ✓
Firewall policies are missing or not allowing the traffic
Why this is correct
Each VDOM needs a policy to allow traffic from the VDOM link interface to the destination.
- ✗
The VDOMs are in different administrative domains
Why it's wrong here
Administrative domains are a FortiManager concept, not a FortiGate VDOM concept.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.