Enabling virtual systems
Enabling virtual systems (VSYSes) on a firewall makes it into a multi-tenant system. Each VSYS represents a virtual firewall instance that can operate independently while sharing the resources available on the host system. The host system still retains control over all networking functions (interfaces and their configurations, routing tables, IPSec and GRE tunnels, DHCP, DNS proxy, and so on) and the management configuration. Each VSYS can be assigned its own (sub) interfaces and routing can either be taken care of at the system level or by creating virtual routers and assigning them to each VSYS.
Important note
By default, each firewall creates its objects in vsys1. This is the native VSYS even for devices that do not support multi-VSYS. Objects created in vsys1 or any other VSYS will not be visible to other VSYSes unless its location is set as shared.
Only the larger physical platforms (PA-3220 and up as of time of writing) support multi-VSYS mode...
