Introduction to Virtual System

Virtual systems (VSYS) divide a physical device into multiple logical virtual firewalls. Each VSYS has its own system resources, performs most of the firewall functionalities, working as a completely independent firewall. Direct communication between VSYSs is not allowed.

VSYS has the following characters:

• Each VSYS has its own administrators;
• Each VSYS has independent virtual routers, zones, address book, service book, etc;
• Each VSYS has independent physical and logical interfaces;
• Each VSYS has independent policy rules.

The supported default VSYS number varies from different platforms. You can expand the number by purchasing and installing a license.

VSYS Objects

This section describes VSYS objects, including root VSYS, non-root VSYS, administrator, VRouter, VSwitch, zone, and interface.

Root VSYS and Non-root VSYS

The system contains only one root VSYS which cannot be deleted. You can create or delete non-root VSYSs after installing a VSYS license and rebooting the device. When creating or deleting non-root VSYSs, you must follow the rules listed below:

• When creating or deleting non-root VSYSs through CLI, you must enter the root VSYS configuration mode.
• Only the administrator with then RXW permission in root VSYS can create or delete non-root VSYS. For more information about administrator permissions, see Administrator.
• When creating a non-root VSYS, the following corresponding objects will be created automatically:
  • An administrator with the RXW permission named admin. The password is vsys_name-admin.
  • A VRouter named vsys_name-vr.
  • A L3 zone named vsys_name-trust.
  For example, when creating the non-root VSYS named vsys1, the following objects will be created:
  • The RXW administrator named admin with the password vsys1-admin.
  • The default VRouter named vsys1-vr.
  • The L3 zone named vsys1-trust and it is bound to vsys1-vr automatically.
• When deleting a non-root VSYS, all the objects in the VSYS will be deleted simultaneously.
• The root VSYS contains a default VSwitch named VSwitch1, but there is no default VSwitch in a newly created non-root VSYS. Therefore, before creating L2 zones in a non-root VSYS, a VSwitch must be created. The first VSwitch created in a non-root VSYS will be considered as the default VSwitch, and the L2 zone created in the non-root VSYS will be bound to the default VSwitch automatically.

Administrator

Administrators in different VSYSs are independent from each other. Administrators in root VSYS are known as root administrators and administrators in non-root VSYS are known as non-root administrators. The system supports two types of administrator permissions which are RX (read-execute) and RXW (read-execute-write). For more information about how to configure administrator permission, see Configuring an Admin Account.

When creating VSYS administrators, you must follow the rules listed below:

• Backslash (\) cannot be used in administrator names.
• The non-root administrators are created by root RXW administrators after logging into non-root VSYS.
• After logging into root VSYS, the root administrators can switch to non-root VSYS and configure it.
• Non-root administrators can enter the corresponding non-root VSYS after successful login, but the non-root administrators cannot switch to the root VSYS.
• Each administrator name should be unique in the VSYS it belongs to, while administrator names can be the same in different VSYSs. In such a case, when logging in, you must specify the VSYS the administrator belongs to in form of vsys_name\admin_name. If no VSYS is specified, you will enter the root VSYS.

The following table shows the permissions to different types of VSYS administrators.

VRouter, VSwitch, Zone, Interface

VRouter, VSwitch, zone, and interface in VSYS have two properties which are shared and dedicated. Objects with dedicated property are dedicated objects, while doing specific operations to the object with the shared property will make it a shared object. The dedicated object and shared object have the following characters:

• Dedicated object: A dedicated object belongs to a certain VSYS, and cannot be referenced by other VSYSs. Both root VSYS and non-root VSYS can contain dedicated objects.
• Shared object: A shared object can be shared by multiple VSYSs. A shared object can only belong to the root VSYS and can only be configured in the root VSYS. A non-root VSYS can reference the shared object, but cannot configure them. The name of the shared object must be unique in the whole system.

The following figure shows the reference relationship among dedicated and shared VRouter, VSwitch, zone, and interface.

As shown in the figure above, there are three VSYSs in StoneOS: Root VSYS, VSYS-A, and VSYS B.

Root VSYS contains shared objects (including Shared VRouter, Shared VSwitch, Shared L3-zone, Shared L2-zone, Shared IF1, and Shared IF2) and dedicated objects.

VSYS-A and VSYS-B only contain dedicated objects. The dedicated objects VSYS-A and VSYS-B can reference the shared objects in Root VSYS. For example, A-zone2 in VSYS-A is bound to the shared object Shared VRouter in Root VSYS, and B-IF3 in VSYS-B is bound to the shared object Shared L2-zone in Root VSYS.

Shared VRouter

A shared VRouter contains the shared and dedicated L3 zones of the root VSYS. After binding the L3 zone with the shared property to a shared VRouter, it becomes a shared L3 zone.

Shared VSwitch

A shared VSwitch contains the shared and dedicated L2 zones of the root VSYS. After binding the L2 zone with the shared property to a shared VSwitch, it becomes a shared L2 zone.

Shared Zone

The shared zones consist of L2 shared zones and L3 shared zones. After binding the L2 zone with the shared property to a shared VSwitch, it becomes a shared L2 zone; after binding the L3 zone with the shared property to a shared VRouter, it becomes a shared L3 zone. A shared zone can contain interfaces in both root VSYS and non-root VSYS. All functional zones cannot be shared.

Shared Interface

After binding an interface in the root VSYS to a shared zone, it becomes a shared interface automatically.

Interface Configuration

Only RXW administrator in the root VSYS can create or delete interfaces. Configurations to an interface and its sub-interfaces must be performed in the same VSYS.