is an independent (virtual) firewall instance that you can separately manage within a physical firewall. Each vsys can be an independent firewall with its own security policy, interfaces, and administrators; a vsys enables you to segment the administration of all policies, reporting, and visibility functions that the firewall provides. For example, if you want to customize the security features for the traffic that is associated with your Finance department, you can define a Finance vsys and then define security policies that pertain only to that department. To optimize policy administration, you can maintain separate administrator accounts for overall firewall and network functions while creating vsys administrator accounts that allow access to individual vsys. This allows the vsys administrator in the Finance department to manage the security policies only for that department.
Networking functions (such as static and dynamic routing, IP addresses of interfaces, and IPSec tunnels) pertain to an entire firewall and all of its virtual systems. A virtual system configuration (
Device > Virtual Systems
) doesn’t control firewall-level and network-level functions (such as static and dynamic routing, IP addresses of interfaces, IPSec tunnels, VLANs, virtual wires, virtual routers, DHCP, DNS Proxy, QoS, LLDP, and network profiles). For each vsys, you can specify a collection of physical and logical firewall interfaces (including VLANs and virtual wires) and security
zones. If you require routing segmentation for each vsys, you must create and assign additional virtual routers and assign interfaces, VLANs, and virtual wires as needed.
Before defining vsys,
you must first enable the multiple vsys capability on the firewall—select
Device > Setup > Management , edit the
General Settings , select
Multi Virtual System Capability , and click
OK . This adds a
Device > Virtual Systems
page. Select the page, click
Add , and specify the following information.
| Virtual System Setting | Description |
|---|---|
|
|
If you use a Panorama template to configure the vsys, this field does not appear. |
|
|
If you use a Panorama template to push vsys configurations, the vsys name in the template must match the vsys name on the firewall. |
|
|
. |
|
|
|
|
|
|
