Is it possible to send traffic from Fortigate-1 InterVDOM to Fortigate-2 InterVDOM ?. I have LACP routed interface between Fortigate 1 and Fortigate 2, both firewalls can ping each other.Both are running FortiOS 7.4.11. Fortigate 1,all lan ports are LACP with multiple VLAN uplinks from switches. Fortigate 2,multiple interVDOM links created between rootVDOM and cust-1 to 3 VDOMs. interVDOM link interface for rootVDOM is configured as 0. customer VDOMs, static routing & firewall policies are created to respective interlink. root VDOM, static routing and firewall policies are created to Fortigate 1 and other VDOMs on this Fortigate. When i try pinging from customer VDOM to Fortigate-1 VDOMS, it keeps on looping on InterVDOM link of respective customer VDOM. In a nutshell, can’t reach between VDOMS of both Fortigates. I’m using “ethernet” instead of “ppp” and segments from APIPA range((169.254.0.0/16) for interVDOM link. What i’m trying to achieve, is it supported ?. Am i missing anything ?. Thanks in advance.

again, it’s link-local. It works to route between two vdoms. Just can’t advertise it to, or accessed from, outside of those two vdoms.unless you use the vdom-link to pass multi-cast/broadcast protocols, the default ppp should work. We exclusively use npu-vlink for performance and never use vdom-link. So it doesn’t have that option but OSPF is working over it. It’s just a simple setting. Just test both ways yourself.And, I still recommend using npu-vlink instead.I wouldn’t recommend “relying on policies to route” traffic like an old firewalls. Treating the FGTs as routers would provide more solid “routing” especially when you have many VDOMs (routers) in the network, and avoid trouble in the future when the network topology needs changes.doesn’t have to be, just one side is “0” and the other side is “1”.Toshi

eby

Explorer

Question

Help Req: Routing traffic between Fortigate-1 InterVDOM to Fortigate-2 InterVDOM.

Forum|Forum|12 days ago
July 3, 2026
4 replies
75 views

Is it possible to send traffic from Fortigate-1 InterVDOM to Fortigate-2 InterVDOM ?.

I have LACP routed interface between Fortigate 1 and Fortigate 2, both firewalls can ping each other.

Both are running FortiOS 7.4.11.

Fortigate 1,

all lan ports are LACP with multiple VLAN uplinks from switches.

Fortigate 2,

multiple interVDOM links created between rootVDOM and cust-1 to 3 VDOMs.
- interVDOM link interface for rootVDOM is configured as 0.
customer VDOMs, static routing & firewall policies are created to respective interlink.
root VDOM, static routing and firewall policies are created to Fortigate 1 and other VDOMs on this Fortigate.

When i try pinging from customer VDOM to Fortigate-1 VDOMS, it keeps on looping on InterVDOM link of respective customer VDOM.

In a nutshell, can’t reach between VDOMS of both Fortigates.

I’m using “ethernet” instead of “ppp” and segments from APIPA range((169.254.0.0/16) for interVDOM link.

What i’m trying to achieve, is it supported ?. Am i missing anything ?.

Thanks in advance.

funkylicious

SuperUser

As far as I know and have seen it work, inter-vdom routing works only between vdoms on the same FGT and i dont think it works between different physical devices.

Try instead to create a VLAN interface and assign it to the correct vdom in each FGT, route the traffic accordingly and make sure that its also created/added at the L2 in the network, then create the appropriate firewall rules to allow traffic.

"jack of all trades, master of none"

ebyAuthor

Explorer

Between physical devices, it is routed interface.

funkylicious

SuperUser

ok, got it.

so, based on my experience APIPA assigned ip’s on the FGT can be configured but issues appeared when traffic from Windows devices needed to be routed through them, it would just drop. i since then preferred to use 100.64.0.0/10 to assigned ips.

so, based on your design where root VDOM on both FGTs have a routed interface, you would need:

on FGT-1 : vdom-A <> root - intervdom link, with routes on vdom-A towards the dest nets on FGT-2 using it , same goes for vdom-root ( to have routes to the source on vdom-A and dst on FGT-2 vdom-root ) and firewall rules on both vdoms

on FGT-2 : root ( routes towards source nets on FGT-1 towards routed interface on FGT-1, routes towards the dest vdom using the inter-vdom link, firewall rules in place ) <> vdom-B - inter-vdom link, where on vdom-B you need routes for the nets on FGT-1 towards the inter-vdom link and firewall rules

"jack of all trades, master of none"

Toshi_Esumi

SuperUser

I don’t quite understand your diagram. But I guessed what you meant like below my drawing. I focused ONLY on VDOM connections and ignored everything else like WAN or LAN links.
If that’s what you meant, both root VDOMs on both FGTs need to have routes for all those yellow VDOMs (sources and destinations) to route traffic for both directions. You can use link-local (APIPA) IP range for those vdom-links (or nput-vlinks) but those IPs are link-local and not reachable from the other side (FGT) . But I assume you don’t care.
Of course, for access control, you can use policies at either or both of source or destination VDOMs.

Toshi

ebyAuthor

Explorer

Yes, exactly like your diagram. And each customer vdom have its own WAN ports.

ebyAuthor

Explorer

Because traffic is not passing from customerVDOM to rootVDOM of Fortigate-2

i need clarity in following,

Are APIPA range for interVDOM links supported ?.
should i use “ppp” instead of “ethernet” when creating interVDOM links.
should i create interVDOM link without assigning IP.
should interVDOM link interface for rootVDOM be 0.

Should all aggregate interfaces passing VLAN be in rootVDOM ?. Here customerVDOM have LAN ip/gateway configured on respective VDOM interface(no VLANS passing).

And on FGT-1, aggregate interfaces+VLANS passing+VLAN ip/gateway are configured on FGT.
This is to prevent internal L3 routing on switch side.

Toshi_Esumi

SuperUser

again, it’s link-local. It works to route between two vdoms. Just can’t advertise it to, or accessed from, outside of those two vdoms.
unless you use the vdom-link to pass multi-cast/broadcast protocols, the default ppp should work. We exclusively use npu-vlink for performance and never use vdom-link. So it doesn’t have that option but OSPF is working over it. It’s just a simple setting. Just test both ways yourself.
And, I still recommend using npu-vlink instead.
I wouldn’t recommend “relying on policies to route” traffic like an old firewalls. Treating the FGTs as routers would provide more solid “routing” especially when you have many VDOMs (routers) in the network, and avoid trouble in the future when the network topology needs changes.
doesn’t have to be, just one side is “0” and the other side is “1”.

Toshi

ebyAuthor

Explorer

update, after replacing all APIPA addresses from interVDOM with 10.255.255.x/30(on both firewalls), it started working as it should !!!!.

I have a G series box with np7lite, and i assume all vlinks are automatically on vlink as i’m getting error for "set interface" command.

Fortinet example contain the following,

set interface "npu0_vlink0" <----- The npu accelerated virtual link port on 'root' VDOM. set vlanid 100

Fortigate G series - v7.4.11

edit "vdom47-0" set vdom "root" set ip 10.255.255.130 255.255.255.252 set allowaccess ping set type vdom-link set snmp-index 50 set macaddr x:x:x:x:x:x next edit "vdom47-1" set vdom "47-VDOM" set ip 10.255.255.129 255.255.255.252 set allowaccess ping set type vdom-link set snmp-index 51 set macaddr x:x:x:x:x:x next

# edit vdom47-0 (vdom47-0) # set interface command parse error before 'interface'

Thanks,

Sign up

Login with SSO

Login to the community

Login with SSO