The ticket
Customer A traceroute shows Customer B’s LAN. Someone redistributed both into one OSPF on root. VDOM was a label, not a boundary.
FortiOS VDOM (virtual domain) splits a FortiGate into independent virtual firewalls (split-task operation: management vs traffic VDOMs in some designs). Each traffic VDOM has its own FIB and policy. Inter-VDOM links are virtual cables — you still need addresses, routes, and policies both sides. Global objects exist; do not assume isolation without looking at routing.
FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.
Mental model
root = HQ. Tenant-A = a second FortiGate that happens to share the PSU. They do not share sessions.
Tenant-A
How to choose
One company, one VDOM (root). Two security domains or two customers: VDOM. Hardware limit: check the SKU VDOM license before promising ten tenants.
Runbook
Side A — enable
Global VDOM mode. Create Tenant-A. Move port3.
Side B — no leak
Do not add Tenant-A LAN to root OSPF. Inter-VDOM only with a policy you can explain.
Side C — prove
From Tenant-A CLI routing table: no 10.20.30.0/24 unless designed. Tenant admin cannot edit root policy.
config vdom
edit Tenant-A
end
get router info routing-table all
# should NOT list HQ 10.20.30.0/24 unless you built the linkFour failures
1 · Shared WAN without SNAT plan
Two tenants, one public. Design NAT or buy two WANs.
2 · Inter-VDOM any-any
You undid isolation.
3 · Admin in all VDOMs
Not multi-tenant; just extra clicks.
4 · License
Box supports 10 VDOMs, you sold 11.
How to prove it
1) Each VDOM FIB is separate. 2) Cross traffic has a named policy. 3) Tenant admin scope is Tenant-A.
Traps
| Looks isolated | Is not |
|---|---|
| Two policy packages | One routing table |
| Different colors in GUI | Inter-VDOM any-any |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview
Sources
Related: FortiGate session factory · VPN series.