Device > Virtual Systems

A virtual system (vsys) is an independent (virtual) firewall instance that you can separately manage within a physical firewall. Each vsys can be an independent firewall with its own security policy, interfaces, and administrators; a vsys enables you to segment the administration of all policies, reporting, and visibility functions that the firewall provides. For example, if you want to customize the security features for the traffic that is associated with your Finance department, you can define a Finance vsys and then define security policies that pertain only to that department. To optimize policy administration, you can maintain separate administrator accounts for overall firewall and network functions while creating vsys administrator accounts that allow access to individual vsys. This allows the vsys administrator in the Finance department to manage the security policies only for that department.

Networking functions, including static and dynamic routing, pertain to an entire firewall and all its vsys; vsys do not control firewall- and network-level functions. For each vsys, you can specify a collection of physical and logical firewall interfaces (including VLANs and virtual wires) and security zones. If you require routing segmentation for each vsys, you must create/assign additional virtual routers and assign interfaces, VLANs, and virtual wires as needed.

If you use a Panorama template to define vsys, you can set one vsys as the default. The default vsys and Multiple Virtual Systems mode determine whether firewalls accept vsys-specific configurations during a template commit:

Additional points to consider before enabling multiple virtual systems:

Before defining vsys, you must first enable the multiple vsys capability on the firewall—select Device > Setup > Management, edit the General Settings, select Multi Virtual System Capability, and click OK. This adds a Device > Virtual Systems page. Select the page, click Add, and specify the following information.