Skip to main content
canoas
Visitor III
January 13, 2026
Question

VLAN's from different VDOMs into same Security interface zone

  • January 13, 2026
  • 4 replies
  • 474 views

I have created 2 x vdoms, each vdom has a vlan assigned to a single physical port (set interface "port#").

 

If I create a security zone named "Zone1," the only option is to assign a VLAN from that specific VDOM.

 

Both physical ports are connected to a switch, which will be trunked wth both vlans. Ideally, I would like to use the same 2 physical interfaces in each vdom with the same VLAN interface IP address in Security Zone1,  for failover redundancy (each vdom will have a zone named "Zone1")

 

How is this possible? Not wanting inter-vdom links, is there another option, as you can only set 1 physical port per VLAN interface?  Would this be switch mode on the fortigate?

 

Example - if I lose a port, no traffic will be pass to a specific vdom

4 replies

funkylicious
SuperUser
SuperUser
January 13, 2026

having separate vdoms means the interfaces in different vdoms cannot share a common zone, a vdom is basically a 'virtual' firewall instance each with its own routing table, interfaces/vlans, etc. 

maybe you would want a redundant interface instead https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-a-redundant-link/ta-p/196577 ?

"jack of all trades, master of none"
Toshi_Esumi
SuperUser
SuperUser
January 13, 2026

Or, I think it's simply not possible. VDOMs are equivalent to physical separated FW units. One vdom can't refer or share another vdom's properties.

Toshi

canoas
canoasAuthor
Visitor III
January 13, 2026

how about creating a LAG interface in the root vdom, adding both both ports physical ports to the LAG interface, then assigning the LAG interface to the VLAN interface to each VDOM?

 

config system interface
edit "LAG-CORE"
set vdom "root"
set type aggregate
set member "x5" "x6"
set lacp-mode active
next
end

then add "LAG-CORE to each VLAN Interface rather than the physical port? Won't this mean I have redundancy i.e:

if x5 goes down traffic will still pass both both vdoms because each VLAN interface is assign to LAG-CORE?

 

I think my initial post was very explanatory! 

funkylicious
SuperUser
SuperUser
January 13, 2026

try a hardware/software/vlan switch instead of LAG and maybe

"jack of all trades, master of none"
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!