Hello, I am trying to setup a VDOM-Exception
reference:
Administration Guide | FortiGate / FortiOS 7.2.0 | Fortinet Documentation Library
When I go enter conf sys vdom-exception and edit 1, the only option I have is to "set object". Per the documentation, I should be able to "set scope" and "set vdom".
Further, when I go into "set object", I am missing most of the options. I can only set logs and a couple of system settings, but no interfaces, firewall, router or any other functional items.
I am engaged with my SE on this and it has been escalated, however they are confused as well. I have tried this on 4 different ha clusters of firewalls with different versions of firmware ranging from 6.4.7 to 7.2.0 and using FGT60e's, FGT300e's, FGT501e's and FGTVM's.
Any idea on how to get this working?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
This is mainly used if you need to override the default/global settings used for some/required vdoms. So the selected object should be those that needs an override from defaults.For example,
config system vdom-exception
edit 1
set object log.fortianalyzer.override-setting
set scope inclusive
set vdom "Student"
next
end
best regards,
Jin
To elaborate on Jin's post:
- the FortiGate will sometimes hide/not allow settings before a different parameter is set
- in the VDOM expection settings, you must first specify an object, and THEN you can specify scope, and if scope is inclusive/exclusive, THEN you can specify VDOMs.
You have something similar with interface settings in CLI for example - you can only set an IP if the interface is set to static; if it's set to DHCP, there is no 'set ip' option available.
Thank you both for your replies.
Jin, I am using VDOM Exceptions because I would like to have a HA cluster members in different physical sites. I need a unique vdom at each location for connectivity to different subnets.
Debbie, I did try to set the object parameter just as you did in your example, however I still do not have any additional options.
Hi,
You should be able to use the override-setting objects for different connectivity for different vdoms.
Best regards,
Jin
Created on 07-15-2023 01:11 AM Edited on 07-15-2023 01:34 AM
You didn't answer the question. Look at Technical Tip: Exclude few config to sync between HA members with 'vdom-exception' - there are many more objects there (including "no interfaces, firewall, router or any other functional items") than those available at CLI in 7.x.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1516 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.