Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
BrianD
New Contributor

Vdom-Exceptions not showing all options

Hello, I am trying to setup a VDOM-Exception

 

reference:

Administration Guide | FortiGate / FortiOS 7.2.0 | Fortinet Documentation Library

 

 When I go enter conf sys vdom-exception and edit 1, the only option I have is to "set object". Per the documentation, I should be able to "set scope" and "set vdom". 

Further, when I go into "set object", I am missing most of the options. I can only set logs and a couple of system settings, but no interfaces, firewall, router or any other functional items.

 

I am engaged with my SE on this and it has been escalated, however they are confused as well. I have tried this on 4 different ha clusters of firewalls with different versions of firmware ranging from 6.4.7 to 7.2.0 and using FGT60e's, FGT300e's, FGT501e's and FGTVM's.

 

Any idea on how to get this working?

5 REPLIES 5
jintrah_FTNT
Staff
Staff

Hi,

 

This is mainly used if you need to override the default/global settings used for some/required vdoms. So the selected object should be those that needs an override from defaults.For example,

 

config system vdom-exception
edit 1
set object log.fortianalyzer.override-setting
set scope inclusive
set vdom "Student"
next
end

 

best regards,

Jin

 

Debbie_FTNT
Staff
Staff

To elaborate on Jin's post:

- the FortiGate will sometimes hide/not allow settings before a different parameter is set

- in the VDOM expection settings, you must first specify an object, and THEN you can specify scope, and if scope is inclusive/exclusive, THEN you can specify VDOMs.

Debbie_FTNT_0-1651216445686.png

You have something similar with interface settings in CLI for example - you can only set an IP if the interface is set to static; if it's set to DHCP, there is no 'set ip' option available.

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
BrianD
New Contributor

Thank you both for your replies.

Jin, I am using VDOM Exceptions because I would like to have a HA cluster members in different physical sites. I need a unique vdom at each location for connectivity to different subnets. 

 

Debbie, I did try to set the object parameter just as you did in your example, however I still do not have any additional options. 2022-04-29 08_28_43-FortiGate - FW1 and 4 more pages - Work - Microsoft​ Edge.jpg

jintrah_FTNT

Hi,

 

You should be able to use the override-setting objects for different connectivity for different vdoms.

 

Best regards,

Jin

 

AlexFerenX

You didn't answer the question. Look at Technical Tip: Exclude few config to sync between HA members with 'vdom-exception' - there are many more objects there (including "no interfaces, firewall, router or any other functional items") than those available at CLI in 7.x.

Top Kudoed Authors