topic Re: create a new Vsys queries. in General Topics

create a new Vsys queries.

SachinGargNTT — Thu, 16 Nov 2023 11:50:07 GMT

Wish to configure new VSYS, will it cause any issue while configuring?

Do we need to reboot after enabling Multi-vsys opention?

Will it will cause network disruption over default VSYS1?

· Will it will affect the functionality of Access Control Policy on the default VSYS1?

· Will it will affect the entire functionality of default VSYS1?

· Could you share with us a best practices for VSYS creation?

- Will it cause any downtime?

- What difference do we have when we have Panorama in place?

- Any best practice, when we have HA in place?

Re: create a new Vsys queries.

reaper — Thu, 16 Nov 2023 14:03:27 GMT

- after enabling multi-vsys support you will need to reboot the device, adding new vsys after that is simply a matter of creating and committing the config

- it will not change/impactchange functionality of vsys1 (you may need to take a look at your shared objects and 'move' your virtual router into vsys1

- AFAIK there's no real best practice... create a new vsys and give it a name

- the initial reboot is needed to enable vsys, and you may have a very short VirtualRouter restart if you move it from shared to vsys1

- in panorama you'll need to start creating vsys specific configuration, so if you currently have the firewall in panorama and the config (policies, objects,...) are set to shared, you need to move them to vsys1. each vsys will (kind of) show as a different firewall on panorama

- same as with the single vsys. ha config is 'shared' on the chassis anyway so that cannot live in a specific vsys, so no real changes there

rgds

Tom

Re: create a new Vsys queries.

SachinGargNTT — Thu, 16 Nov 2023 14:26:32 GMT

SO, it means for HA-standby , we need to enable VSYS and post first commit all its a regular job of FW - sync with primary FW across chassis.

Re: create a new Vsys queries.

reaper — Mon, 20 Nov 2023 09:55:02 GMT

multi vsys support need to be enabled on both chassis, then you can create new vsys's which will be synced via HA sync