Can Root VDOM share the same IPs as other VDOMs?

[IrbkOrrum]

I know that you can have like VDOM-A and VDOM-B that both have the same IP space, such as 10.10.0.0/16 when Root is just passing traffic to physical interfaces.  However, can you have Root have the same IP space as VDOM-A if all traffic runs through root without having any 'leakage' between VDOMs?  
For example, you've got 1 port to the internet that all VDOM traffic (including root) runs through and 1 port that all traffic runs too for the VM stack.  So all traffic runs through the Root vdom but VDOM-A would share the same IP space without leakage? 

[dingjerry_FTNT]

Hi @IrbkOrrum ,

You may treat the VDOMs as individual sub-FortiGate devices.  So yes, of course, the root VDOM can use the same IPs as other VDOMs.

However, when the traffic from other VDOMs entering into the root VDOM, it has to be NATted.  Otherwise, it will confuse the root VDOM how to return the traffic, or the root VDOM will drop the traffic due to RPF check:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Details-about-FortiOS-RPF-Reverse-Path-For...

[sjoshi]

Yes, it is possible to have same IP range on 2 different VDOM on FGT.

So does the traffic from Inet, VM  stack have to reach VDOMA?

[IrbkOrrum]

Yes, kind of.  My thought process is that "root" could be the "primary production" site and then VDOM-A would be a "bubble" that's only for Disaster recovery testing.  The only thing that would get into VDOM-A would be an IPSec VPN connection for clients that need to test a DR recovery.  This would share the same IP space as production so it's important that we not have any crossover.  I've tested this with a VDOM-A and a VDOM-B and it works fine.  Never tried it where the primary production is taking place in the Root vdom though.