# VDOM: two firewalls in one chassis — until you leak

Source: https://ai.techclick.in/blog_fortigate_vdom_tenant_split
Markdown: https://ai.techclick.in/blog_fortigate_vdom_tenant_split.md
Publisher: Techclick Infosec Pvt Ltd

VDOMs isolate policy and routing. Dummy root vs Tenant-A. Do not leak routes.

## The ticket

 Customer A traceroute shows Customer B’s LAN. Someone redistributed both into one OSPF on root. VDOM was a label, not a boundary.

  Quick interview answer

 FortiOS  VDOM  (virtual domain) splits a FortiGate into independent virtual firewalls (split-task operation: management vs traffic VDOMs in some designs). Each traffic VDOM has its own FIB and policy.  Inter-VDOM links  are virtual cables — you still need addresses, routes, and policies both sides. Global objects exist; do not assume isolation without looking at routing.

  Hero · two tenants

 A VDOM without a routing boundary is a folder.
  Lab data · dummy only
 FortiGate  fgt-hq  mgmt  10.10.10.1  · WAN  203.0.113.10  · LAN  10.20.30.0/24  · FortiManager  10.10.10.5  · FortiAnalyzer  10.10.10.6  · Priya  10.20.30.80  · branch peer WAN  198.51.100.10  · Azure VPN GW public  203.0.113.50  · AWS VGW public  203.0.113.60 . RFC 5737. Not a customer.

## Mental model

 root = HQ. Tenant-A = a second FortiGate that happens to share the PSU. They do not share sessions.

     https://fgt-hq.techclick-lab.in

     Training mock · not live

       Admin

       Dashboard  Policy  VPN  Network

       Global → System → VDOM

### Tenant-A

        VDOM name  Tenant-A

  Type  Traffic

  Interfaces  port3 (Customer A LAN)

  Admin  admin-a  —  access: Tenant-A only

  Inter-VDOM  npu0_vlink0 to root (only if designed)

        Cancel  Save

   FortiOS 7.4 VDOM. Training mock.

## How to choose

 One company, one VDOM (root). Two security domains or two customers: VDOM. Hardware limit: check the SKU VDOM license before promising ten tenants.

## Runbook

- #### Side A — enable Global VDOM mode. Create Tenant-A. Move port3.

- #### Side B — no leak Do not add Tenant-A LAN to root OSPF. Inter-VDOM only with a policy you can explain.

- #### Side C — prove From Tenant-A CLI routing table: no 10.20.30.0/24 unless designed. Tenant admin cannot edit root policy.

  Which VDOM am I in?  config vdom
    edit Tenant-A
end
get router info routing-table all
# should NOT list HQ 10.20.30.0/24 unless you built the link

## Four failures

### 1 · Shared WAN without SNAT plan

 Two tenants, one public. Design NAT or buy two WANs.

### 2 · Inter-VDOM any-any

 You undid isolation.

### 3 · Admin in all VDOMs

 Not multi-tenant; just extra clicks.

### 4 · License

 Box supports 10 VDOMs, you sold 11.

## How to prove it

  Close only when

 1) Each VDOM FIB is separate. 2) Cross traffic has a named policy. 3) Tenant admin scope is Tenant-A.

## Traps

   Looks isolated  Is not

  Two policy packages  One routing table
  Different colors in GUI  Inter-VDOM any-any

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       A VDOM is closest to…

           A VLAN only
           A virtual FortiGate with its own policy and routing
           A VIP
           A FortiAnalyzer ADOM

       Correct:  b . Concept.

       Q2
       Inter-VDOM link is…

           Automatic full mesh
           A virtual cable you must address, route, and policy
           A replacement for IPsec
           A FortiGuard service

       Correct:  b . Interview.

       Q3
       Customer A sees Customer B routes. What leaked?

           Routing / inter-VDOM / shared IGP
           SSL inspection CA
           HA priority
           NTP

       Correct:  a . Ticket.

       Q4
       Tenant admin should…

           Be scoped to Tenant-A
           Always be super_admin
           Use HTTP on WAN
           Edit root VIP

       Correct:  a . Failure 3.

       Q5
       One public IP, two VDOMs. You must design…

           SNAT / IP pool / separate WANs
           Nothing
           Disable NAT forever
           Delete root

       Correct:  a . Failure 1.

       Q6
       Proof of isolation?

           Tenant-A routing table lacks the other LAN
           Same policy id numbers
           Same admin
           One zone name

       Correct:  a . Runbook.

       Check answers
       Reset

  FortiGate class series:   FGT / FMG / FAZ  ·  First day  ·  Policy first match  ·  SNAT vs VIP  ·  Profiles + SSL  ·  debug flow  ·  IPsec S2S  ·  SSL-VPN vs RA  ·  SD-WAN SLA  ·  VDOM  ·  FGCP HA  ·  Interview

## Sources

- FortiOS 7.4 — Virtual domains (VDOM) .

 Related:  FortiGate session factory  ·  VPN series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt