Technical Tip: Global objects in multi-vdom and advanced ADOM mode behavior in FortiManager and FortiGate

[vraev]

Description

This article describes how to use the global object in advanced ADOM mode in FortiManager.

Scope

FortiManager, FortiGate.

Solution

Note:  

• This is expected behavior due to the separation of the ADOM database.
• The type of external connectors can be different per version.
• Advanced ADOM device mode must be enabled to assign VDOMs across different ADOMs. Normal mode does not permit cross‑VDOM ADOM assignment.

The following example is used for the test.

FortiGate with GLOBAL, root, VDOM1 ('multi-vdom' enabled).

config system global
	set vdom-mode multi-vdom
end

FortiManager with an Administrative domain in advanced mode.

config system global
	set adom-mode advanced
	set adom-status enable
end

FortiGate GLOBAL and root VDOM are in the root ADOM of the FortiManager. VDOM1 VDOM is present in ADOM1 ADOM:

 The possible external connectors in FortiGate GLOBAL are shown below.

The possible external connectors in FortiGate VDOM1 VDOM are shown below.

Create in FortiManager a g-object in Policy & Objects, assign it to a policy, and install it in the root VDOM of the FortiGate.

The g-object is visible under the FortiGate VDOMs but not in the FortiManager ADOM1.

 

If the g-object is used in a policy under VDOM1 VDOM and retrieved (root ADOM and Import under ADOM1 ADOM).

It will be visible in the Policy & Objects of ADOM1.