Inter-VDOM Routing Configuration
A FortiGate administrator needs to configure a policy that allows traffic from VDOM A to VDOM B using inter-VDOM routing. Which configuration is required?
Quick Answer
The correct answer is that policies must be configured in both VDOMs to allow traffic to and from the inter-VDOM link. This is required because inter-VDOM routing operates as a logical point-to-point connection between VDOMs, and FortiGate enforces stateful inspection at each VDOM boundary—meaning traffic leaving VDOM A must be permitted by a policy there, and the returning or forwarded traffic entering VDOM B must be explicitly allowed by a separate policy in VDOM B. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding that inter-VDOM routing is not a trust relationship; a common trap is assuming a single policy in one VDOM suffices for bidirectional traffic. Remember the memory tip: “Two VDOMs, two policies—one for the outbound, one for the inbound.”
⚠ Common exam trap
Test-takers frequently assume a single policy in the source VDOM is sufficient, forgetting that FortiGate treats each VDOM as a separate virtual firewall requiring its own policy for return traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policies in both VDOMs allowing traffic to and from the inter-VDOM link
Inter-VDOM routing requires explicit policy enforcement on both sides of the inter-VDOM link. A single policy in VDOM A cannot control return traffic from VDOM B, and FortiGate does not implicitly allow traffic between VDOMs. Therefore, policies must be configured in both VDOMs to permit traffic in both directions, ensuring stateful inspection and security controls are applied consistently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A single policy in VDOM A with destination VDOM B
Why it's wrong here
A single policy in VDOM A cannot reference VDOM B as a destination; policies match interfaces, not VDOM names. Inter-VDOM routing needs an inter-VDOM link with a policy in each VDOM. Single-policy configurations suit standard interface-to-interface traffic within one VDOM, not cross-VDOM transit.
- ✗
A static route in VDOM A pointing to VDOM B
Why it's wrong here
A static route alone cannot forward traffic between VDOMs; FortiGate requires an inter-VDOM link interface pair to carry packets across the VDOM boundary. Static routes are the right choice for directing traffic out a physical interface toward an external next-hop gateway, not for internal VDOM-to-VDOM transit.
- ✓
Policies in both VDOMs allowing traffic to and from the inter-VDOM link
Why this is correct
Inter-VDOM links terminate in both VDOMs, so each side needs a firewall policy permitting traffic across the link. Without policies in both VDOM A and VDOM B, the implicit deny drops packets, so this satisfies the bidirectional inter-VDOM routing requirement.
- ✗
Disable VDOM security features
Why it's wrong here
Disabling VDOM security features removes the firewall's stateful inspection and policy enforcement between virtual instances, which inter-VDOM routing still requires. It is tempting because administrators disable features to troubleshoot connectivity, but the correct configuration is an inter-VDOM link plus a policy permitting traffic, not stripping security.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured with multiple VDOMs. The administrator needs to allow traffic from a VDOM named 'CustomerA' to reach a server in VDOM 'SharedServices'. Both VDOMs are on the same FortiGate. Which configuration is necessary?
medium- A.Place both VDOMs in the same ADOM in FortiManager
- ✓ B.Enable inter-VDOM routing and create policies allowing traffic between the VDOMs
- C.Create a VDOM link between the two VDOMs
- D.Configure the FortiGate in transparent mode
Why B: Inter-VDOM routing is required to route traffic between VDOMs on the same FortiGate. This is enabled globally via the CLI command 'config system global' and 'set inter-vdom-routing enable'. Once enabled, you must create firewall policies between the VDOMs (using the VDOM link or directly referencing the VDOMs in policies) to permit the traffic. Without inter-VDOM routing, VDOMs are isolated Layer 3 domains and cannot communicate.
Variation 2. An enterprise FortiGate has multiple VDOMs. The administrator wants to allow traffic from VDOM A to reach servers in VDOM B without traversing an external router. Which configuration is required?
medium- A.Place both VDOMs in the same VDOM group
- B.Configure a static route in each VDOM pointing to the other VDOM's management IP
- ✓ C.Create an inter-VDOM link using the 'config system interface' command with type 'vdom-link'
- D.Enable VDOM forwarding in global settings
Why C: Inter-VDOM links are the native FortiGate mechanism for routing traffic between VDOMs without external hardware. Created via 'config system interface' with type 'vdom-link', they act as a direct Layer 3 connection between VDOMs, allowing traffic to flow internally through the FortiGate's backplane. This avoids the need for an external router or physical cabling.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.