Configuring GSLB Objects

Steps for configuration

Setting up an application for use with FortiAppSec Cloud involves two main steps:

1. Configure an FQDN for your application. This is done in GSLB Services > Create FQDN. See FQDN for more information on configuration settings.

   Those using FortiADC, FortiGate, and FortiWeb can easily connect their services to GSLB with One-Click. One-Click enabled connectors automatically set up an FQDN. Therefore, if you choose to set up your application using the One-Click method, you don't need to perform this step manually.

2. Add your connector device to the FQDN created in the previous step. This is typically done in Organization > Fabric Connectors, but procedures vary for different kinds of connectors. Refer to Fabric connector for detailed instructions on how to integrate your connector to GSLB.

Allow 1 to 2 minutes for GSLB to reload with the updated configurations.

Configuration example

The following is an example of how to set up GSLB with two devices: a Generic-Host connector and a FortiADC connector.

Scenario

The administrator manages the following devices:

• An HTTP service running on a FortiADC device in Oregon, USA
• An HTTP service running on a 3rd party device in Beijing, China

The administrator wants to achieve the following:

• The HTTP services should back up one another
  • DNS queries from China will be directed to the HTTP service IP address in Beijing, while queries from the United States will be directed to the HTTP service IP address in Oregon.
  • When the HTTP service in Oregon goes down, the HTTP service IP address in Beijing will respond.

    When the HTTP service in Beijing goes down, the HTTP service IP address in Oregon will respond.

    When both HTTP services go down, a default IP address will respond.

How to deploy this scenario

1. Enable One-Click on FortiADC, following the procedure for setting up FortiADC connectors.
2. Make sure the Connector FortiADC in Oregon is connected to GSLB.
   1. Go to Fabric Connectors > Create Connector
3. Make sure the FQDN is synced to GSLB.
   1. Navigate to GSLB Services and find the FQDN generated in step 2. Since this is a One-Click-enabled FQDN, its name typically follows the format OC_HostName_DomainName.
      
   2. Update Pool Select Method. See Virtual Server Pool for more information on your configuration options.
      1. Click the pencil icon to edit the FQDN. The administrator's preferences outlined in the example scenario indicate that we should set the Virtual Server Pool Selection Method to DNS-Query-Origin.
         
   3. Update the location list for the existing pool created by One-Click.
      1. Scroll to the bottom of the Edit FQDN modal and locate the available member in the table. The name of this member should follow the format OCM_HostName.DomainName. Click the Edit icon.
         
      2. Click Create Location List and add United States as a region. Click Save and go back to the member pool page.
         
      3. Click Save. This brings you back to the Edit FQDN page. Save again to return to the FQDN service detail page.
4. Add the HTTP service in Beijing to FQDN.
   1. In the FQDN service detail page, click Pool and then click Add pool.
   2. Add a member pool for Beijing.
      
   3. Click Create Location List and add China as a region. Click Save and go back to the member pool page.
   4. Click Create Virtual Server Pool and create a pool for Beijing. Click Save.
   5. Click Create Member > Create Virtual Server > Create Connector and create a connector for Beijing.
      
   6. Click Create Data Center and create a China data center. Click Save and go back to the Create Connector page. Save the connector.
   7. Go to the Create Virtual Server page and create a virtual server. Click Save. This brings you back to the Edit Member Virtual Server page.
      
   8. Click Save. This brings you back to the Create Pool page.
   9. Click Save. This brings you back to the Add Member Pool page.
   10. Click Save. This brings you back to the FQDN service detail page.
   11. The Virtual Servers table now displays that the HTTP service in Beijing has been added to FQDN.
       

Troubleshooting

1. Click on the left-most icon in the top right corner to see your Assigned DNS server addresses.
   The Primary Anycast IP refers to the IP address returned for the One Click GSLB Server. However, in all other aspects, the Primary and Secondary IP addresses are equivalent and either one can be used for domain management tools that only require one address.
   
2. Use the DNS tool dig to query the service with one of your IP addresses.