T Techclick ← All lessons
Fortinet · FortiOS 7.4 · Lesson 10 of 12

VDOM: two firewalls in one chassis — until you leak

MSP wants two customers on one FortiGate. A VDOM is a virtual FortiGate: own interfaces, routing table, policies, admins. Inter-VDOM links are cables you invented. If you share a default route carelessly, you built one firewall with extra menus.

Updated 2026-08-18·16 min read·L2 primary·Quiz at end

After this page you can

The ticket

Customer A traceroute shows Customer B’s LAN. Someone redistributed both into one OSPF on root. VDOM was a label, not a boundary.

Quick interview answer

FortiOS VDOM (virtual domain) splits a FortiGate into independent virtual firewalls (split-task operation: management vs traffic VDOMs in some designs). Each traffic VDOM has its own FIB and policy. Inter-VDOM links are virtual cables — you still need addresses, routes, and policies both sides. Global objects exist; do not assume isolation without looking at routing.

Hero · two tenants
Two VDOMs isolated like two firewalls
A VDOM without a routing boundary is a folder.
Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

root = HQ. Tenant-A = a second FortiGate that happens to share the PSU. They do not share sessions.

https://fgt-hq.techclick-lab.in
Training mock · not live
DashboardPolicyVPNNetwork
Global → System → VDOM

Tenant-A

Tenant-A
Traffic
port3 (Customer A LAN)
admin-a — access: Tenant-A only
npu0_vlink0 to root (only if designed)
FortiOS 7.4 VDOM. Training mock.

How to choose

One company, one VDOM (root). Two security domains or two customers: VDOM. Hardware limit: check the SKU VDOM license before promising ten tenants.

Runbook

  1. Side A — enable

    Global VDOM mode. Create Tenant-A. Move port3.

  2. Side B — no leak

    Do not add Tenant-A LAN to root OSPF. Inter-VDOM only with a policy you can explain.

  3. Side C — prove

    From Tenant-A CLI routing table: no 10.20.30.0/24 unless designed. Tenant admin cannot edit root policy.

Which VDOM am I in?
config vdom
    edit Tenant-A
end
get router info routing-table all
# should NOT list HQ 10.20.30.0/24 unless you built the link

Four failures

1 · Shared WAN without SNAT plan

Two tenants, one public. Design NAT or buy two WANs.

2 · Inter-VDOM any-any

You undid isolation.

3 · Admin in all VDOMs

Not multi-tenant; just extra clicks.

4 · License

Box supports 10 VDOMs, you sold 11.

How to prove it

Close only when

1) Each VDOM FIB is separate. 2) Cross traffic has a named policy. 3) Tenant admin scope is Tenant-A.

Traps

Looks isolatedIs not
Two policy packagesOne routing table
Different colors in GUIInter-VDOM any-any

Knowledge check

Judgment items. One best answer. Reasons send you back to the matching section.

Q1

A VDOM is closest to…

Correct: b. Concept.
Q2

Inter-VDOM link is…

Correct: b. Interview.
Q3

Customer A sees Customer B routes. What leaked?

Correct: a. Ticket.
Q4

Tenant admin should…

Correct: a. Failure 3.
Q5

One public IP, two VDOMs. You must design…

Correct: a. Failure 1.
Q6

Proof of isolation?

Correct: a. Runbook.

FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview

Sources

Related: FortiGate session factory · VPN series.