root ADOM. For information on how to back up the configuration, see Backups. Administrative domains (ADOMs) enable the admin administrator to constrain other FortiWeb administrators’ access privileges to a subset of policies and protected host names. This can be useful for large enterprises and multi-tenant deployments such as web hosting.
ADOMs are not enabled by default. Enabling and configuring administrative domains can only be performed by the admin administrator.
Enabling ADOMs alters the structure of and the available functions in the GUI and CLI, according to whether or not you are logging in as the admin administrator, and, if you are not logging in as the admin administrator, the administrator account’s assigned access profile.
admin administrator account |
Other administrators | |
|---|---|---|
Access to config global |
Yes | No |
| Can create administator accounts | Yes | No |
| Can create & enter all ADOMs | Yes | No |
admin, a superset of the typical CLI commands appear, allowing unrestricted access and ADOM configuration.config global contains settings used by the FortiWeb itself and settings shared by ADOMs, such as RAID and administrator accounts. It does not include ADOM-specific settings or data, such as logs and reports. When configuring other administrator accounts, an additional option appears allowing you to restrict other administrators to an ADOM.
By default, administrator accounts other than the admin account are assigned to the root ADOM, which includes all policies and servers. By creating ADOMs that contain a subset of policies and servers, and assigning them to administrator accounts, you can restrict other administrator accounts to a subset of the FortiWeb’s total protected servers.
The admin administrator account cannot be restricted to an ADOM. Other administrators are restricted to their ADOM, and cannot configure ADOMs or global settings.
1. Log in with the admin account.
Other administrators do not have permissions to configure ADOMs.
|
|
Back up your configuration. Enabling ADOMs changes the structure of your configuration, and moves non-global settings to the root ADOM. For information on how to back up the configuration, see Backups. |
2. Go to System > Status > Status, then in the System Information widget, in the Administrative Domains row, click Enable.
FortiWebterminates your administrative session.
3. Log in again.
When ADOMs are enabled, and if you log in as admin, the navigation menu on the left changes: the two top level items are Global and Administrative Domain.
This menu and CLI structure change is not visible to non-global accounts; ADOM administrators’ navigation menus continue to appear similar to when ADOMs are disabled, except that global settings such as network interfaces, HA, and other global settings do not appear.
admin or other accounts with the prof_admin access profile can change. 4. Continue by defining ADOMs (Defining ADOMs).
1. Delete all ADOM administrator accounts.
|
|
Back up your configuration. Disabling ADOMs changes the structure of your configuration, and deletes most ADOM-related settings. It keeps settings from the root ADOM only. For information on how to back up the configuration, see Backups. |
2. Go to System > Status > Status, then in the System Information widget, in the Administrative Domains row, click Disable.
3. Continue by reconfiguring the appliance (How to set up your FortiWeb).
Some settings can only be configured by the admin account — they are global. Global settings apply to the appliance overall regardless of ADOM, such as:
SYN flood anti-DoS settingexec ping and other global operations that exist only in the CLIOnly the admin account can configure global settings.
|
In the current release, some settings, such as user accounts for HTTP authentication, anti-defacement, and logging destinations are read-only for ADOM administrators. Future releases will allow ADOM administrators to configure these settings separately for their ADOM. |
Other settings can be configured separately for each ADOM. They essentially define each ADOM. For example, the policies of adom-A are separate from adom-B.
Initially, only the root ADOM exists, and it contains settings such as policies that were global before ADOMs were enabled. Typically, you will create additional ADOMs, and few if any administrators will be assigned to the root ADOM.
After ADOMs are created, the admin account usually assigns other administrator accounts to configure their ADOM-specific settings. However, as the root account, the admin administrator does have permission to configure all settings, including those within ADOMs.
1. Log in with the admin account.
Other administrators do not have permissions to configure ADOMs.
2. Go to Global > System > Administrative Domain > Administrative Domain.
|
|
The maximum number of ADOMs you can add varies by your FortiWeb model. The number of ADOMs is limited by available physical memory (RAM), and therefore also limits the maximum number of policies and sessions per ADOM. See Appendix B: Maximum configuration values. |
3. Click Create New, enter the Name, then click OK.
The new ADOM exists, but its settings are not yet configured. . (Alternatively, to configure the default root ADOM, click root.)
4. Do one of the following:
The admin administrator can create other administrators and assign their account to an ADOM, constraining them to that ADOM’s configurations and data.
1. If you have not yet created any administrator access profiles, create at least one. See Configuring access profiles.
2. In the administrator account’s Access Profile setting, select the new access profile.
(Administrators assigned to the prof_admin access profile will have global access. They cannot be restricted to an ADOM.)
3. In the administrator account’s Administrative Domain setting, select the account’s assigned ADOM. Currently, in this version of FortiWeb, administrators cannot be assigned to more than one ADOM.