Simple definition
A VDOM (Virtual Domain) splits a FortiGate into multiple virtual firewalls that can operate as independent logical units.
Technical definition
In multi-VDOM mode, each VDOM can have its own security policies and, in NAT mode, separate routing and VPN configurations. Some resources and settings remain global to the FortiGate. Communication between VDOMs must be designed explicitly, for example through inter-VDOM links or a management-VDOM architecture.
What is it used for?
Separate customers, branches, environments, or security zones on one physical appliance while keeping policies and routing tables logically independent.
Practical example
A service provider hosts two customers on one FortiGate. Each customer has its own VDOM, logical interfaces, firewall policies, and routing. Traffic remains isolated unless an inter-VDOM path is deliberately configured.
Common issues
- Interface assigned to the wrong VDOM
- Route or policy created in the wrong VDOM context
- Confusion between global and per-VDOM settings
- Missing or incorrectly routed inter-VDOM link
Key takeaway: When troubleshooting a multi-VDOM FortiGate, first confirm the current VDOM; a correct configuration in the wrong VDOM will still have no effect.