1.3 Virtual Domains (VDOMs) & System Operation Modes

Virtual Domains (VDOMs) & System Operation Modes

FortiOS Virtual Domains (VDOMs) enable network administrators to partition a single physical FortiGate hardware appliance or virtual machine into multiple logically independent security firewalls. Each VDOM functions as a completely autonomous unit, maintaining its own dedicated network interfaces, routing tables, security policies, VPN tunnels, and administrative access profiles.

---

Virtual Domain (VDOM) Fundamentals & Multi-Tenancy

VDOM architecture brings multi-tenancy to network security infrastructure. It allows Managed Security Service Providers (MSSPs) and enterprise organizations to isolate departments (e.g., HR, Finance, Engineering) or customer tenants on shared hardware while maintaining strict administrative and traffic separation.

Key VDOM Capabilities

• Independent Resource Allocation: Interfaces, VLAN subinterfaces, and IPsec tunnels are assigned to specific VDOMs.
• Routing Table Segregation: Each VDOM runs isolated routing daemons (BGP, OSPF, static routes). overlapping IP address spaces across different VDOMs are fully supported.
• Granular Security Policies: Firewall policies and Security Profiles (AV, IPS, Web Filter) are authored independently per VDOM.
• Role-Based Administration: Administrators can be granted full control over a single VDOM without exposing global platform settings.

---

VDOM Modes: Split-Task vs. Multi-VDOM

FortiOS 7.6 supports two administrative VDOM operational topologies:

1. Split-Task VDOM Mode: Segregates the system into exactly two VDOMs:
   • mgmt-vdom: Dedicated exclusively to administrative management traffic, FortiGuard updates, FortiAnalyzer logging, and DNS queries.
   • root: Dedicated exclusively to customer data traffic forwarding and security policy enforcement.
2. Multi-VDOM Mode: Enables full multi-tenancy, permitting administrators to create multiple custom VDOMs (up to physical platform or license limits) alongside global system management.

Enabling Multi-VDOM Mode via CLI

Enabling multi-VDOM mode alters global system configuration structures. Executing the mode change forces an administrative session logout.

config system global
    set vdom-mode multi-vdom
end

---

Global Context vs. VDOM Context

When VDOMs are enabled, the CLI environment splits into two operating contexts: Global Context and VDOM Context.

CLI Navigation and Privileges

# Enter Global Context (System-wide hardware, global objects, physical interface assignment)
config global
    config system interface
        edit "port3"
            set vdom "Accounting-VDOM"
        next
    end
end

# Enter specific VDOM Context (VDOM-specific routing, policies, security profiles)
config vdom
    edit "Accounting-VDOM"
        config router static
            edit 1
                set gateway 10.200.1.1
                set device "port3"
            next
        end
    end

---

System Operation Modes: NAT/Route Mode vs. Transparent Mode

Each VDOM (or a non-VDOM FortiGate) operates in one of two fundamental network layer modes: NAT/Route Mode or Transparent Mode.

1. NAT/Route Mode (Layer 3)

In NAT/Route Mode (the default operational mode), the FortiGate functions as a Layer 3 network router. Interfaces are assigned IP addresses across distinct IP subnets. The FortiGate routes traffic between interfaces based on its routing table while performing Network Address Translation (NAT) and stateful packet inspection.

2. Transparent Mode (Layer 2)

In Transparent Mode, the FortiGate functions as a Layer 2 bridge or transparent switch. Physical interfaces do not have IP addresses assigned. The FortiGate forwards packets transparently between network segments based on MAC address tables while continuing to enforce Layer 4 firewall policies and Layer 7 Security Profile inspection.

Transparent Mode Management Setup

To manage a Transparent Mode VDOM, a dedicated Management IP address (manageip) and default gateway are assigned to the system settings node:

config system settings
    set opmode transparent
    set manageip 192.168.1.99 255.255.255.0
    set gateway 192.168.1.1
end

[!IMPORTANT] In Transparent Mode, all interfaces assigned to the VDOM belong to the same broadcast domain by default. To prevent broadcast loops, administrators must configure Virtual Virtual Local Area Networks (VLANs) or forward domains (set forward-domain).

---

Inter-VDOM Links (vdom-link)

When multiple VDOMs exist on a single FortiGate, traffic transferring between VDOMs normally requires exiting a physical interface, traversing an external switch, and re-entering another physical interface. Inter-VDOM Links (vdom-link) eliminate physical cabling by creating a pair of connected virtual network interfaces inside the FortiOS kernel.

Hardware Acceleration & Interface Types

• NPU-Accelerated vdom-link: Processed directly by Network Processor (NPU) ASIC chips (e.g., NP6, NP7), delivering line-rate throughput with minimal CPU overhead.
• Software vdom-link: Processed by the general CPU daemon; used when NPU acceleration is unavailable.

Inter-VDOM Link CLI Configuration

# Step 1: Create the virtual inter-VDOM link pair in Global Context
config global
    config system vdom-link
        edit "vlink-corp-to-dmz"
        next
    end
    
    # Assign interface endpoints to target VDOMs
    config system interface
        edit "vlink-corp-to-dmz0"
            set vdom "Corporate-VDOM"
            set ip 172.16.1.1 255.255.255.252
            set allowaccess ping
        next
        edit "vlink-corp-to-dmz1"
            set vdom "DMZ-VDOM"
            set ip 172.16.1.2 255.255.255.252
            set allowaccess ping
        next
    end
end

Once the endpoints are assigned, administrators create static routes and firewall policies in both VDOMs, referencing the respective vlink interfaces to permit secure inter-VDOM traffic flow.

---

NAT/Route Mode vs. Transparent Mode Architectural Matrix