Vdom-Exceptions not showing all options

[BrianD]

Hello, I am trying to setup a VDOM-Exception

reference:

Administration Guide | FortiGate / FortiOS 7.2.0 | Fortinet Documentation Library

 When I go enter conf sys vdom-exception and edit 1, the only option I have is to "set object". Per the documentation, I should be able to "set scope" and "set vdom". 

Further, when I go into "set object", I am missing most of the options. I can only set logs and a couple of system settings, but no interfaces, firewall, router or any other functional items.

I am engaged with my SE on this and it has been escalated, however they are confused as well. I have tried this on 4 different ha clusters of firewalls with different versions of firmware ranging from 6.4.7 to 7.2.0 and using FGT60e's, FGT300e's, FGT501e's and FGTVM's.

Any idea on how to get this working?

[jintrah_FTNT]

Hi,

This is mainly used if you need to override the default/global settings used for some/required vdoms. So the selected object should be those that needs an override from defaults.For example,

config system vdom-exception
edit 1
set object log.fortianalyzer.override-setting
set scope inclusive
set vdom "Student"
next
end

best regards,

Jin

[Debbie_FTNT]

To elaborate on Jin's post:

- the FortiGate will sometimes hide/not allow settings before a different parameter is set

- in the VDOM expection settings, you must first specify an object, and THEN you can specify scope, and if scope is inclusive/exclusive, THEN you can specify VDOMs.

You have something similar with interface settings in CLI for example - you can only set an IP if the interface is set to static; if it's set to DHCP, there is no 'set ip' option available.

[BrianD]

Thank you both for your replies.

Jin, I am using VDOM Exceptions because I would like to have a HA cluster members in different physical sites. I need a unique vdom at each location for connectivity to different subnets. 

Debbie, I did try to set the object parameter just as you did in your example, however I still do not have any additional options. 

[jintrah_FTNT]

Hi,

You should be able to use the override-setting objects for different connectivity for different vdoms.

Best regards,

Jin

[AlexFerenX]

You didn't answer the question. Look at Technical Tip: Exclude few config to sync between HA members with 'vdom-exception' - there are many more objects there (including "no interfaces, firewall, router or any other functional items") than those available at CLI in 7.x.