Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

FortiGate-6000 Handbook

Example FortiGate-6000 FGSP configuration

This example shows how to configure FGSP to synchronize sessions between two FortiGate-6301s for the root VDOM and for a second VDOM, named vdom-1. The example uses the HA1 interfaces of each FortiGate-6301F for session synchronization. The HA1 interfaces are connected to the 172.25.177.0/24 network. You could also connect and configure the HA2 interfaces and use them for session synchronization.

The interfaces of the two FortiGate-6301Fs must have their own IP addresses and their own network configuration. You can give the FortiGate-6301Fs different host names. This example uses peer_1 and peer_2, to make the FortiGate-6301Fs easier to identify.

This example also adds configuration synchronization and sets the peer_1 device priority higher so that it becomes the config sync primary. Once configuration synchronization is enabled, you can log into peer_1 and add firewall policies and make other configuration changes and these configuration changes will be synchronized to peer_2. For information about configuration synchronization, including its limitations, see Standalone configuration synchronization.

Example FortiGate-6000 FGSP configuration

  1. Configure the routers or load balancers to distribute sessions to the two FortiGate-6301Fs.

  2. Change the host names of the FortiGate-6301Fs to peer_1 and peer_2.
  3. Configure network settings for each FortiGate-6301F to allow them to connect to their networks and route traffic.
  4. Add the vdom-1 VDOM to each FortiGate-6301F.
  5. Configure the HA1 interface of peer_1 with an IP address on the 172.25.177.0/24 network:

    config system interface

    edit ha1

    set ip 172.25.177.10 255.255.255.0

    end

  6. Configure the HA1 interface of peer_2 with an IP address on the 172.25.177.0/24 network:

    config system interface

    edit ha1

    set ip 172.25.177.20 255.255.255.0

    end

  7. On peer_1, configure session synchronization for the root and vdom-1 VDOMs.

    config system cluster-sync

    edit 1

    set peervd mgmt-vdom

    set peerip 172.25.177.20

    set syncvd root vdom-1

    end

    Where, peervd will always be mgmt-vdom and peerip is the IP address of the HA1 interface of peer_2.

    This configuration creates one cluster-sync instance that includes both VDOMs. You could have created a separate cluster-sync instance for each VDOM. If possible, however, avoid creating more than three cluster-sync instances. A fourth cluster-sync instance may experience reduced session synchronization performance.

  8. On peer_1, enable configuration synchronization, configure the heartbeat interfaces, and set a higher device priority. This makes peer_1 become the config sync primary.

    config system ha

    set standalone-config-sync enable

    set priority 250

    set hbdev ha1 50 ha2 50

    end

  9. On peer_2, configure session synchronization for the root and vdom-1 VDOMs.

    config system cluster-sync

    edit 1

    set peervd mgmt-vdom

    set peerip 172.25.177.10

    set syncvd root vdom-1

    end

  10. On peer_2, enable configuration synchronization, configure the heartbeat interfaces, and leave the device priority set to the default value.

    config system ha

    set standalone-config-sync enable

    set hbdev ha1 50 ha2 50

    end

    As sessions are forwarded by the routers or load balancers to one of the FortiGate-6301Fs, the FGSP synchronizes the sessions to the other FortiGate-6301F. You can log into peer_1 and make configuration changes, which are synchronized to peer_2.

Example FortiGate-6000 FGSP configuration

This example shows how to configure FGSP to synchronize sessions between two FortiGate-6301s for the root VDOM and for a second VDOM, named vdom-1. The example uses the HA1 interfaces of each FortiGate-6301F for session synchronization. The HA1 interfaces are connected to the 172.25.177.0/24 network. You could also connect and configure the HA2 interfaces and use them for session synchronization.

The interfaces of the two FortiGate-6301Fs must have their own IP addresses and their own network configuration. You can give the FortiGate-6301Fs different host names. This example uses peer_1 and peer_2, to make the FortiGate-6301Fs easier to identify.

This example also adds configuration synchronization and sets the peer_1 device priority higher so that it becomes the config sync primary. Once configuration synchronization is enabled, you can log into peer_1 and add firewall policies and make other configuration changes and these configuration changes will be synchronized to peer_2. For information about configuration synchronization, including its limitations, see Standalone configuration synchronization.

Example FortiGate-6000 FGSP configuration

  1. Configure the routers or load balancers to distribute sessions to the two FortiGate-6301Fs.

  2. Change the host names of the FortiGate-6301Fs to peer_1 and peer_2.
  3. Configure network settings for each FortiGate-6301F to allow them to connect to their networks and route traffic.
  4. Add the vdom-1 VDOM to each FortiGate-6301F.
  5. Configure the HA1 interface of peer_1 with an IP address on the 172.25.177.0/24 network:

    config system interface

    edit ha1

    set ip 172.25.177.10 255.255.255.0

    end

  6. Configure the HA1 interface of peer_2 with an IP address on the 172.25.177.0/24 network:

    config system interface

    edit ha1

    set ip 172.25.177.20 255.255.255.0

    end

  7. On peer_1, configure session synchronization for the root and vdom-1 VDOMs.

    config system cluster-sync

    edit 1

    set peervd mgmt-vdom

    set peerip 172.25.177.20

    set syncvd root vdom-1

    end

    Where, peervd will always be mgmt-vdom and peerip is the IP address of the HA1 interface of peer_2.

    This configuration creates one cluster-sync instance that includes both VDOMs. You could have created a separate cluster-sync instance for each VDOM. If possible, however, avoid creating more than three cluster-sync instances. A fourth cluster-sync instance may experience reduced session synchronization performance.

  8. On peer_1, enable configuration synchronization, configure the heartbeat interfaces, and set a higher device priority. This makes peer_1 become the config sync primary.

    config system ha

    set standalone-config-sync enable

    set priority 250

    set hbdev ha1 50 ha2 50

    end

  9. On peer_2, configure session synchronization for the root and vdom-1 VDOMs.

    config system cluster-sync

    edit 1

    set peervd mgmt-vdom

    set peerip 172.25.177.10

    set syncvd root vdom-1

    end

  10. On peer_2, enable configuration synchronization, configure the heartbeat interfaces, and leave the device priority set to the default value.

    config system ha

    set standalone-config-sync enable

    set hbdev ha1 50 ha2 50

    end

    As sessions are forwarded by the routers or load balancers to one of the FortiGate-6301Fs, the FGSP synchronizes the sessions to the other FortiGate-6301F. You can log into peer_1 and make configuration changes, which are synchronized to peer_2.