Fortinet black logo

FortiGate-6000 Handbook

Standalone configuration synchronization

Standalone configuration synchronization

FortiGate-6000 supports configuration synchronization (also called standalone configuration synchronization) for two FortiGate-6000s. Configuration synchronization means that most configuration changes made to one of the FortiGate-6000s are automatically synchronized to the other one.

For details about standalone configuration synchronization for FortiOS 6.0, see: Standalone configuration sync.

Use the following command on both FortiGate-6000s to enable configuration synchronization:

config system ha

set standalone-config-sync enable

end

In addition to enabling configuration synchronization, you must set up HA heartbeat connections between the FortiGate-6000s using the HA1 and HA2 interfaces. One HA heartbeat connection is required, two are recommended. Use the following command to enable heartbeat configuration for both the HA1 and HA2 interfaces. This command gives both heartbeat interfaces the same priority. You can choose to select different priorities for each heartbeat interface:

config system ha

set hbdev ha1 50 ha2 50

end

When you enable configuration synchronization, configure and connect the heartbeat devices, FGCP primary unit selection criteria selects a config sync primary (or master) FortiGate-6000. Normally, the FortiGate-6000 with the highest serial number becomes the config sync primary and the other FortiGate-6000 becomes the config sync secondary.

All configuration changes that you make to the primary are synchronized to the secondary. To avoid synchronization problems, Fortinet recommends making all configuration changes to the primary.

Caution

See Limitations for a list of limitations of the configuration synchronization feature. Fortinet recommends disabling configuration synchronization once the configurations of the FortiGate-6000s have been synchronized.

Selecting the config sync primary FortiGate-6000

You can use device priority to select one of the FortiGate-6000s to become the config sync primary. For example, the following command enables configuration synchronization and sets a higher device priority than the default of 128 to make sure that this FortiGate-6000 becomes the primary.

config system ha

set standalone-config-sync enable

set priority 250

end

Settings that are not synchronized

Configuration synchronization does not synchronize settings that identify the FortiGate-6000 to the network. The following settings are not synchronized:

  • Transparent mode management IPv4 and IPv6 IP addresses and default gateways.
  • All config system cluster-sync settings.
  • All config system interface settings except vdom, vlanid, type and interface.
  • All config firewall sniffer settings.
  • All router BFD and BFD6 settings.
  • The following BGP settings: as, router-id, aggregate-address, aggregate-address6, neighbor-group, neighbor, network, and network6.
  • The following OSPF settings: router-id, area, ospf-interface, network, neighbor, and summary-address.
  • The following OSPF6 settings: router-id, area, and ospf6-interface.
  • All RIP settings.
  • All policy routing settings.
  • All static routing settings.

Limitations

When configuration synchronization is enabled, there are some limitations, including but not limited to the following:

  • Configuration synchronization does not support graceful HA firmware upgrades. If you upgrade the firmware of primary, the secondary also upgrades at the same time, disrupting network traffic. You can avoid traffic interruptions by disabling configuration synchronization and upgrading the firmware of each FortiGate-6000 separately.
  • The configuration settings that are synchronized might not match your requirements. The current design and implementation of configuration synchronization is based on requirements from specific customers and might not work for your implementation.
  • It can be difficult to control which FortiGate-6000 becomes the config sync primary and the config sync primary can dynamically change without notice. This could result in accidentally changing the configuration of the secondary or overwriting the configuration of the intended primary.

Standalone configuration synchronization

FortiGate-6000 supports configuration synchronization (also called standalone configuration synchronization) for two FortiGate-6000s. Configuration synchronization means that most configuration changes made to one of the FortiGate-6000s are automatically synchronized to the other one.

For details about standalone configuration synchronization for FortiOS 6.0, see: Standalone configuration sync.

Use the following command on both FortiGate-6000s to enable configuration synchronization:

config system ha

set standalone-config-sync enable

end

In addition to enabling configuration synchronization, you must set up HA heartbeat connections between the FortiGate-6000s using the HA1 and HA2 interfaces. One HA heartbeat connection is required, two are recommended. Use the following command to enable heartbeat configuration for both the HA1 and HA2 interfaces. This command gives both heartbeat interfaces the same priority. You can choose to select different priorities for each heartbeat interface:

config system ha

set hbdev ha1 50 ha2 50

end

When you enable configuration synchronization, configure and connect the heartbeat devices, FGCP primary unit selection criteria selects a config sync primary (or master) FortiGate-6000. Normally, the FortiGate-6000 with the highest serial number becomes the config sync primary and the other FortiGate-6000 becomes the config sync secondary.

All configuration changes that you make to the primary are synchronized to the secondary. To avoid synchronization problems, Fortinet recommends making all configuration changes to the primary.

Caution

See Limitations for a list of limitations of the configuration synchronization feature. Fortinet recommends disabling configuration synchronization once the configurations of the FortiGate-6000s have been synchronized.

Selecting the config sync primary FortiGate-6000

You can use device priority to select one of the FortiGate-6000s to become the config sync primary. For example, the following command enables configuration synchronization and sets a higher device priority than the default of 128 to make sure that this FortiGate-6000 becomes the primary.

config system ha

set standalone-config-sync enable

set priority 250

end

Settings that are not synchronized

Configuration synchronization does not synchronize settings that identify the FortiGate-6000 to the network. The following settings are not synchronized:

  • Transparent mode management IPv4 and IPv6 IP addresses and default gateways.
  • All config system cluster-sync settings.
  • All config system interface settings except vdom, vlanid, type and interface.
  • All config firewall sniffer settings.
  • All router BFD and BFD6 settings.
  • The following BGP settings: as, router-id, aggregate-address, aggregate-address6, neighbor-group, neighbor, network, and network6.
  • The following OSPF settings: router-id, area, ospf-interface, network, neighbor, and summary-address.
  • The following OSPF6 settings: router-id, area, and ospf6-interface.
  • All RIP settings.
  • All policy routing settings.
  • All static routing settings.

Limitations

When configuration synchronization is enabled, there are some limitations, including but not limited to the following:

  • Configuration synchronization does not support graceful HA firmware upgrades. If you upgrade the firmware of primary, the secondary also upgrades at the same time, disrupting network traffic. You can avoid traffic interruptions by disabling configuration synchronization and upgrading the firmware of each FortiGate-6000 separately.
  • The configuration settings that are synchronized might not match your requirements. The current design and implementation of configuration synchronization is based on requirements from specific customers and might not work for your implementation.
  • It can be difficult to control which FortiGate-6000 becomes the config sync primary and the config sync primary can dynamically change without notice. This could result in accidentally changing the configuration of the secondary or overwriting the configuration of the intended primary.