Inter-VLAN Security Policy in Transparent Mode VDOMs
An administrator configures a FortiGate in transparent mode with two VDOMs. Each VDOM is assigned to a different VLAN. The administrator wants to apply a common security policy to traffic between the VLANs. What is the correct approach?
Quick Answer
The correct approach is to use inter-VDOM routing linked to a policy in the global policy set. This is necessary because in transparent mode, each VDOM operates as an isolated Layer 2 domain, and traffic between VLANs assigned to different VDOMs cannot be bridged directly; instead, it must be routed across an inter-VDOM link. By applying the security policy in the global policy set, the administrator ensures that a single, common policy governs all traffic crossing the VDOM boundary, avoiding the complexity of duplicating rules in each VDOM. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of transparent mode VDOM isolation and the distinction between intra-VDOM bridging and inter-VDOM routing. A common trap is assuming that a policy in each VDOM can handle the traffic, but the global policy set is the only place where inter-VDOM traffic is evaluated once. Memory tip: think of the global policy set as the “gatekeeper” at the VDOM border—traffic must pass through it when leaving one VDOM to reach another.
⚠ Common exam trap
Test-takers frequently assume a single VDOM or the root VDOM can handle inter-VLAN policies in transparent mode, but FortiGate requires explicit inter-VDOM routing and global policy sets for cross-VDOM traffic, even in transparent mode.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use inter-VDOM routing linked to a policy in the global policy set
In transparent mode, FortiGate VDOMs are isolated by default, and traffic between VLANs assigned to different VDOMs must traverse an inter-VDOM link. The correct approach is to use inter-VDOM routing and apply a security policy in the global policy set, which allows a common policy to govern traffic crossing VDOM boundaries. This ensures that the policy is evaluated once for inter-VDOM traffic, rather than requiring separate policies in each VDOM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign both VLANs to the same VDOM and apply a policy there
Why it's wrong here
If they are in different VDOMs, they must be separate.
- ✗
Apply the policy on the management VDOM
Why it's wrong here
Management VDOM handles only management traffic.
- ✗
Configure a single policy on the root VDOM that matches all VLANs
Why it's wrong here
Root VDOM is not used for data traffic in transparent mode.
- ✓
Use inter-VDOM routing linked to a policy in the global policy set
Why this is correct
Traffic between VDOMs must go through inter-VDOM routing; a policy in the respective VDOMs is needed.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is configuring a FortiGate in transparent mode for an enterprise network. The existing gateway firewall must remain in place. How should the administrator configure the FortiGate's interfaces to ensure minimal disruption?
medium- A.Enable VDOMs and separate the interfaces into different VDOMs
- ✓ B.Place both interfaces in the same VDOM and assign a shared management IP
- C.Assign each interface a unique IP address on different subnets
- D.Use 802.1Q trunking on a single physical interface
Why B: In transparent mode, FortiGate acts as a Layer 2 bridge, so both interfaces must belong to the same VDOM and share a single management IP to allow administrative access without breaking the Layer 2 path. This configuration ensures the existing gateway firewall remains in place and traffic flows uninterrupted, as the FortiGate does not perform routing between its interfaces.
Variation 2. An administrator is configuring a firewall policy on a FortiGate in transparent mode. The policy should allow HTTP traffic from internal users to the internet. Which source and destination addresses should be used in the policy?
medium- ✓ A.Source: all, Destination: all
- B.Source: the FortiGate's management IP, Destination: the web server's IP
- C.Source: internal subnet, Destination: external subnet
- D.Source: internal MAC addresses, Destination: external MAC addresses
Why A: In transparent mode, the FortiGate operates as a Layer 2 bridge but still inspects Layer 3 headers, so it can match on IP addresses in firewall policies. The correct answer is 'all' for both source and destination because the policy is intended to allow all internal users to any internet destination, and using 'all' ensures the policy applies broadly without unnecessary restrictions. Using specific IP subnets is also possible, but 'all' is simple and commonly used when no further filtering is required.
Variation 3. An administrator is configuring a FortiGate in transparent mode for a retail store. The store has a flat network with a single subnet. Which TWO of the following statements about transparent mode are correct? (Select TWO.)
medium- A.Virtual IPs (VIPs) can be used for destination NAT
- ✓ B.The FortiGate uses a management IP address for administrative access
- C.The FortiGate will perform routing between VLANs
- D.The FortiGate requires a default route to forward user traffic
- ✓ E.Firewall policies can be applied to control traffic between bridge interfaces
Why B: In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses. It does not perform routing (so C is incorrect). A management IP is required for administrative access (B is correct) because the bridged interfaces do not have IPs. Firewall policies can be applied to bridge interfaces to control traffic (E is correct). VIPs for destination NAT are not supported in transparent mode because NAT is a Layer 3 function (A is incorrect). No default route is needed for user traffic as the device is not routing; management traffic may require a route but the question is about user traffic (D is incorrect).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.