Inter-VDOM Traffic Inspection Requirements
An administrator wants to ensure that traffic between two VDOMs on the same FortiGate is properly inspected. Which THREE configurations must be in place?
Quick Answer
The answer is that an inter-VDOM link between the VDOMs must be created, and inspection profiles must be explicitly applied to the firewall policies governing that link. This is correct because inter-VDOM traffic on a FortiGate is routed through a logical inter-VDOM link, which acts as a virtual interface pair; without applying UTM profiles—such as antivirus, web filtering, and IPS—to the policies on that link, the device forwards packets based solely on the accept/deny action, bypassing all deep packet inspection. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of how multi-VDOM architectures enforce security boundaries, and a common trap is assuming that default inspection is applied automatically to inter-VDOM traffic—it is not. Remember the memory tip: “Link first, then inspect—no profile, no protection.”
⚠ Common exam trap
Watch out — candidates often assume SSL inspection must be enabled on the inter-VDOM link interface itself, but FortiGate requires SSL inspection to be configured as part of the inspection profile applied to the firewall policy, not on the interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inspection profiles applied to the policies
Inspection profiles (such as antivirus, web filtering, and IPS) must be explicitly applied to the firewall policies that govern traffic traversing the inter-VDOM link. Without these profiles, the FortiGate will forward traffic between VDOMs based solely on the policy action (accept/deny) without performing any deep packet inspection, leaving the traffic unexamined for threats. This is a fundamental requirement for UTM inspection in a multi-VDOM architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SSL inspection on the inter-VDOM link interface
Why it's wrong here
SSL inspection is applied in the policy, not on the interface.
- ✗
Static routes on both VDOMs pointing to the inter-VDOM link
Why it's wrong here
Routes are necessary for routing, but not directly for inspection; the question asks for inspection.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator is troubleshooting a scenario where traffic between two VDOMs is not working. The admin has configured inter-VDOM routing. Which TWO steps should the administrator verify? (Choose two.)
medium- A.Check that NAT is enabled on the policies
- ✓ B.Check that there is a firewall policy in the destination VDOM allowing the return traffic
- C.Check that the inter-VDOM link is configured as a physical interface
- ✓ D.Check that there is a firewall policy in the source VDOM allowing traffic to the destination VDOM
- E.Check that both VDOMs are in the same administrative VDOM
Why B: Inter-VDOM routing requires firewall policies in both the source and destination VDOMs to permit traffic. The destination VDOM must have a policy allowing the return traffic (from the destination to the source) for the session to be established. Without this, the FortiGate will drop the return packets, breaking the bidirectional flow.
Variation 2. A FortiGate administrator is troubleshooting a scenario where users in VDOM-1 cannot reach a server in VDOM-2. Inter-VDOM routing is configured using a VDOM link. The administrator checks the session table and sees that packets are arriving on the VDOM link interface but are not being forwarded. What is the MOST likely cause?
hard- A.The VDOM link is in the wrong VDOM
- ✓ B.A firewall policy is blocking the traffic from the VDOM link to the destination
- C.The routing table in VDOM-1 does not have a default route
- D.The VDOM link is not administratively up
Why B: When packets arrive on the VDOM link interface but are not forwarded, the issue is typically a missing or misconfigured firewall policy in the destination VDOM (VDOM-2). Even though inter-VDOM routing is correctly set up via the VDOM link, FortiGate requires an explicit firewall policy in the destination VDOM to permit traffic from the VDOM link interface to the destination server. Without this policy, the FortiGate drops the packets after routing, which matches the symptom of packets arriving but not being forwarded.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.