As I understand it, a Vsys is a virtual instance you can assign your virtual routers (VR) to. You can't connect them as a Vsys is the scope of a VR.
Check Virtual Systems:
DEFINING VIRTUAL SYSTEMS
Interfaces and security zones can be grouped into virtual systems, and then managed
independently of each other. For example, if you define virtual systems for the interfaces associated with specific departments or customers, you can then customize the administrative access, security policies, and logging/reporting for each department or customer.
You can also define administrator accounts that
provide administrative or view-only access to a
single virtual system. Initially, all interfaces,
zones, and policies belong to the default virtual
system (vsys1). When you enable multiple virtual systems, note the following:
- Interfaces, zones, VLANs, virtual wires, and virtual routers (VR) must be assigned to a virtual system (a virtual system column is added to the respective pages).
- A virtual system drop-down list is added under the Policies and Objects tabs. Before defining a policy or policy object, you must select the appropriate virtual system.
- Remote logging destinations (SNMP, Syslog, and email), as well as applications, services, and profiles, can be shared by all virtual systems or limited to a selected virtual system.
- Virtual router(s), security zone(s) and VLAN(s) can be defined before creating the vsys or can be added in a later stage by specifying the vsys when the resource is created.
Before configuring virtual systems, they will need to be activated. Activation is done under the device tab from the Setup > Management tab > General settings page. Once the virtual systems feature is enabled, ‘virtual systems’ and ‘shared gateway’ menu items become available in the left tree menu under the device tab. A minimum amount of information is required to begin configuring the first virtual system. Note that vs
ys1 is the default virtual system which is always present.