FortiGate-7000E Handbook

What's New
- What's new for FortiGate-7000 6.0.12
- What's new for FortiGate-7000 6.0.10
- What's new for FortiGate-7000 6.0.9
- What's new for FortiGate-7000 6.0.8
- What's new for FortiGate-7000 6.0.6
- What's new for FortiGate-7000 6.0.4
FortiGate-7000 overview
- FortiGate-7060E
- FortiGate-7040E
- FortiGate-7030E
- FIM-7901E interface module
- FIM-7904E interface module
- FIM-7910E interface module
- FIM-7920E interface module
- FPM-7620E processing module
- FPM-7630E processing module
Getting started with FortiGate-7000
- Multi VDOM mode
- Confirming startup status
- Configuration synchronization
  - Confirming that the FortiGate-7000 is synchronized
  - Viewing more details about FortiGate-7000 synchronization
- FortiGate-7000 dashboard widgets
- Setting up management connections
  - Adding a password to the admin administrator account
- Using data interfaces for management traffic
- Setting the MTU for a data interface
- More management connections than expected for one device
- More ARP queries than expected for one device - potential issue on large WiFi networks
- Replacing a failed FPM or FIM
- Resolving FIM or FPM boot device I/O errors
  - Formatting an FIM boot device and installing new firmware
  - Formatting an FPM boot device and installing new firmware
- Connecting to module CLIs using the System Management Module
- Failover in a standalone FortiGate-7000
- Changing data interface network settings
- Resetting to factory defaults
- Restarting the FortiGate-7000
- Packet sniffing for FIM and FPM packets
- Diagnose debug flow trace for FPM and FIM activity
- Showing how the DP2 processor will load balance a session
Managing individual FortiGate-7000 FIMs and FPMs
- Special management port numbers
- HA mode special management port numbers
- Managing individual FIMs and FPMs from the CLI
- Connecting to individual FIM and FPM CLIs of the secondary FortiGate-7000 in an HA configuration
Firmware upgrades
- Firmware upgrade basics
- Verifying that a firmware upgrade is successful
- Upgrading the firmware running on individual FIMs or FPMs
  - Upgrading the firmware on an individual FIM
  - Upgrading the firmware on an individual FPM
- Installing FIM firmware from the BIOS after a reboot
- Installing FPM firmware from the BIOS after a reboot
- Synchronizing FIMs and FPMs after upgrading the primary FIM firmware from the BIOS
Load balancing and flow rules
- Setting the load balancing method
- Flow rules for sessions that cannot be load balanced
- Determining the primary FPM
- SSL VPN load balancing
- FortiOS Carrier GTP load balancing
  - Optimizing NPU GTP performance
  - Enabling GTP load balancing
- ICMP load balancing
- Load balancing fragmented ICMP packets
- Adding a flow rule to support DHCP relay
- Default configuration for traffic that cannot be load balanced
FortiGate-7000 IPsec VPN
- IPsec VPN load balancing
- Troubleshooting
FortiGate-7000 high availability
- New HA features and changes
- Introduction to FortiGate-7000 FGCP HA
- Before you begin configuring HA
- Connect the M1 and M2 interfaces for HA heartbeat communication
  - Default HA heartbeat VLAN triple-tagging
  - HA heartbeat VLAN double-tagging
- Basic FortiGate-7000 HA configuration
- Confirming that the FortiGate-7000 HA cluster is synchronized
  - Viewing more details about HA cluster synchronization
- Setting up HA management connections
- Primary FortiGate-7000 selection with override disabled (default)
- Primary FortiGate-7000 selection with override enabled
- Failover protection
  - Device failure
  - FIM failure
  - Link failure
  - FPM failure
  - Session failover
  - Primary FortiGate-7000 recovery
- HA cluster firmware upgrades
- Distributed clustering
- Modifying heartbeat timing
- Changing how long routes stay in a cluster unit routing table
- Session failover (session-pickup)
- Primary FortiGate-7000 selection
- Primary FortiGate-7000 selection and override
- Link failover (port monitoring or interface monitoring)
- Remote link failover
- FortiGate-7000 FGSP
  - FGSP session synchronization options
  - Example FortiGate-7000 FGSP configuration
- Standalone configuration synchronization
- FortiGate-7000 VRRP HA
FortiLink support
ICAP support
SSL mirroring support
FortiGate-7000 v6.0.12 special features and limitations
FortiGate-7000 v6.0.10 special features and limitations
FortiGate-7000 v6.0.9 special features and limitations
FortiGate-7000 v6.0.8 special features and limitations
FortiGate-7000 v6.0.6 special features and limitations
FortiGate-7000 v6.0.4 special features and limitations
FortiGate-7000 config CLI commands
FortiGate-7000 execute CLI commands
Change log

Home FortiGate-7000 6.0.12 FortiGate-7000E Handbook

6.0.12

Introduction to FortiGate-7000 FGCP HA

FortiGate-7000 supports active-passive FortiGate Clustering Protocol (FGCP) HA between two (and only two) identical FortiGate-7000s. You can configure FortiGate-7000 HA in much the same way as any FortiGate HA setup except that only active-passive HA is supported, and even though FortiGate-7000s are configured with VDOMS, virtual clustering is not supported.

You must use the 10Gbit M1 and M2 interfaces for HA heartbeat communication. See Connect the M1 and M2 interfaces for HA heartbeat communication. Heartbeat packets are VLAN-tagged and you can configure the VLANs used. You must configure the switch interfaces used to connect the M1 and M2 interfaces in trunk mode and the switches must allow the VLAN-tagged packets.

As part of the FortiGate-7000 HA configuration, you assign each of the FortiGate-7000s in the HA cluster a chassis ID of 1 or 2. The chassis IDs just allow you to identify individual FortiGate-7000s and do not influence primary unit selection.

If both FortiGate-7000s in a cluster are configured with the same chassis ID, both chassis begin operating in HA mode without forming a cluster. A message similar to the following is displayed on the CLI console of both devices:

HA cannot be formed because this box's chassis-id 1 is the same from the HA peer 'F76E9D3E17000001' chassis-id 1.

As well, a log message similar to the following is created:

Jan 29 16:29:46 10.160.45.70 date=2020-01-29 time=16:29:51 devname="CH-02" devid="F76E9D3E17000001" slot=1 logid="0108037904" type="event" subtype="ha" level="error" vd="mgmt-vdom" eventtime=1580344192162305962 tz="-0800" logdesc="Device set as HA master" msg="HA group detected chassis-id conflict" ha_group=7 sn="F76E9DT018900001 chassis-id=1"

You can resolve this issue by logging into one of the FortiGates and changing its Chassis ID to 2. When this happens, the two chassis will form a cluster.

Example FortiGate-7040 HA configuration

In a FortiGate-7000 FGCP HA configuration, the primary (or master) FortiGate-7000 processes all traffic. The secondary FortiGate-7000 operates in hot standby mode. The FGCP synchronizes the configuration, active sessions, routing information, and so on to the secondary FortiGate-7000. If the primary FortiGate-7000 fails, traffic automatically fails over to the secondary.