Domains
A domain is DataPower's unit of configuration isolation. Think of it as a self-contained workspace: each domain has its own services, objects, files, and logs, separate from every other domain on the same gateway.
The default domain vs. application domains
defaultdomain — always present. It holds device-wide configuration: network interfaces, DNS, system-level users, firmware, and the management interfaces. You generally keep application services out of here.- Application domains — you create one per application, team, environment, or tenant. Services you build (gateways, proxies) live in these.
Why isolate with domains?
- Multi-tenancy. Different teams or applications share one gateway without seeing or breaking each other's configuration.
- Blast-radius control. Restarting, importing, or breaking one domain doesn't affect the others.
- Delegated administration. You can grant a user rights to their domain only, not the whole device.
- Clean promotion. A domain's configuration can be exported and imported as a unit when promoting from dev → test → prod.
What lives in a domain
Each application domain has its own:
- Services (Multi-Protocol Gateways, Web Service Proxies, etc.)
- Configuration objects (handlers, policies, crypto profiles, AAA policies)
- A file system with directories such as
local:,cert:, andtemporary: - Log targets and log files
Shared vs. isolated
Network connectivity, system users, and firmware are device-wide (configured
in default). Application configuration is domain-local. A crypto key you
upload into one domain is not visible to another unless you put it there too.
Common file stores inside a domain
| Store | Purpose |
|---|---|
local: | Your configuration files, stylesheets, scripts |
cert: | Certificates and keys (write-only for keys; not readable back) |
store: | Read-only system-provided files (sample stylesheets, schemas) |
temporary: | Scratch space, cleared on restart |
logtemp: / logstore: | Log files |
We'll create our own application domain in the labs.
Knowledge Check
What kind of configuration belongs in the default domain?
Why create separate application domains?