Technical Tip: Global objects in multi-vdom and advanced ADOM mode behavior in FortiManager and FortiGate

Description

This article describes how to use the global object in advanced ADOM mode in FortiManager.

Scope

FortiManager, FortiGate.

Solution

Note:  

• This is expected behavior due to the separation of the ADOM database.
• The type of external connectors can be different per version.
• Advanced ADOM device mode must be enabled to assign VDOMs across different ADOMs. Normal mode does not permit cross‑VDOM ADOM assignment.

The following example is used for the test.

FortiGate with GLOBAL, root, VDOM1 ('multi-vdom' enabled).

config system global 	set vdom-mode multi-vdom end

FortiManager with an Administrative domain in advanced mode.

config system global 	set adom-mode advanced 	set adom-status enable end

FortiGate GLOBAL and root VDOM are in the root ADOM of the FortiManager. VDOM1 VDOM is present in ADOM1 ADOM:

 The possible external connectors in FortiGate GLOBAL are shown below.

The possible external connectors in FortiGate VDOM1 VDOM are shown below.

Create in FortiManager a g-object in Policy & Objects, assign it to a policy, and install it in the root VDOM of the FortiGate.

The g-object is visible under the FortiGate VDOMs but not in the FortiManager ADOM1.

If the g-object is used in a policy under VDOM1 VDOM and retrieved (root ADOM and Import under ADOM1 ADOM).

It will be visible in the Policy & Objects of ADOM1.