Example FortiGate 7000F FGSP session synchronization with a data interface LAG

This example shows how to configure FGSP to synchronize sessions between two FortiGate-7121Fs for the root VDOM and for a second VDOM, named vdom-1. For FGSP session synchronization, the example uses a data interface LAG that includes the 1-P17, 1-P18, 2-P17, and 2-P18 interfaces.

To set up the configuration, start by giving each FortiGate-7121F a different host name to make them easier to identify. This example uses peer_1 and peer_2. On each FortiGate-7121F, create a VDOM named fgsp-sync and move the 1-P17, 1-P18, 2-P17, and 2-P18 interfaces to this VDOM. Then create a LAG named Data-int-lag, also in the fgsp-sync VDOM, that includes the 1-P17, 1-P18, 2-P17, and 2-P18 interfaces. The LAGs on both FortiGate-7121Fs are on the 172.25.177.0/24 network.

This example also adds standalone configuration synchronization and sets the peer_1 device priority higher so that it becomes the config sync primary. Once configuration synchronization is enabled, you can log into peer_1 and add firewall policies and make other configuration changes and these configuration changes will be synchronized to peer_2. For information about configuration synchronization, including its limitations, see Standalone configuration synchronization.

Example FortiGate 7000F FGSP configuration using data interface LAGs

1. Configure the routers or load balancers to distribute sessions to the two FortiGate-7121Fs.

2. Change the host names of the FortiGate-7121Fs to peer_1 and peer_2.
3. Configure network settings for each FortiGate-7121F to allow them to connect to their networks and route traffic.
4. Add the vdom-1 and fgsp-sync VDOMs to each FortiGate-7121F.
5. Also on each FortiGate-7121F, move the 1-P17, 1-P18, 2-P17, and 2-P18 interfaces to the fgsp-sync VDOM.

6. On peer_1, configure the 1-P17, 1-P18, 2-P17, and 2-P18 interfaces to be FGSP session synchronization data interfaces.

   config system standalone-cluster

   set standalone-group-id 7

   set group-member-id 1

   set data-intf-session-sync-dev 1-P17 1-P18 2-P17 2-P18

   end

7. On peer_1, add a data interface LAG to the fgsp-sync VDOM.

   config system interface

   edit Data-int-lag

   set type aggregate

   set vdom fgsp-sync

   set member 1-P17 1-P18 2-P17 2-P18

   set ip 172.25.177.110/24

   set mtu-override enable

   set mtu 9216

   end

   This configuration adds the data interface LAG to the fgsp-sync VDOM, includes the four data interfaces configured to be FGSP session synchronization interfaces, and configures the LAG to support jumbo frames.

8. On peer_1, configure session synchronization for the root and vdom-1 VDOMs.

   config system cluster-sync

   edit 1

   set peervd fgsp-sync

   set peerip 172.25.177.120

   set syncvd root vdom-1

   end

   peervd is fgsp-sync because the FGSP session synchronization data interfaces are in the fgsp-sync VDOM.

   peerip is the IP address of the data interface LAG added to peer_2.

   This configuration creates one cluster-sync instance that includes both VDOMs. You could have created a separate cluster-sync instance for each VDOM. If possible, however, avoid creating more than three cluster-sync instances. A fourth cluster-sync instance may experience reduced session synchronization performance.

9. On peer_1, enable configuration synchronization, enable session pickup, configure the heartbeat interfaces, and set a higher device priority. This makes peer_1 become the config sync primary.

   config system ha

   set standalone-config-sync enable

   set session-pickup enable

   set session-pickup-connectionless enable

   set session-pickup-expectation enable

   set session-pickup-nat enable

   set priority 250

   set hbdev 1-M3 100 2-M3 100

   end

10. On peer_2, configure the 1-P17, 1-P18, 2-P17, and 2-P18 interfaces to be FGSP session synchronization data interfaces.

    config system standalone-cluster

    set standalone-group-id 7

    set group-member-id 2

    set data-intf-session-sync-dev 1-P17 1-P18 2-P17 2-P18

    end

11. On peer_2, add a data interface LAG to the fgsp-sync VDOM.

    config system interface

    edit Data-int-lag

    set type aggregate

    set vdom fgsp-sync

    set member 1-P17 1-P18 2-P17 2-P18

    set ip 172.25.177.120/24

    set mtu-override enable

    set mtu 9216

    end

    This configuration adds the data interface LAG to the fgsp-sync VDOM, includes the four data interfaces configured to be FGSP session synchronization interfaces, and configures the LAG to support jumbo frames.

12. On peer_2, configure session synchronization for the root and vdom-1 VDOMs.

    config system cluster-sync

    edit 1

    set peervd fgsp-sync

    set peerip 172.25.177.110

    set syncvd root vdom-1

    end

13. On peer_2, enable configuration synchronization, configure the heartbeat interfaces, and leave the device priority set to the default value.

    config system ha

    set standalone-config-sync enable

    set session-pickup enable

    set session-pickup-connectionless enable

    set session-pickup-expectation enable

    set session-pickup-nat enable

    set hbdev 1-M3 100 2-M3 100

    end

    As sessions are forwarded by the routers or load balancers to one of the FortiGate-7121Fs, the FGSP synchronizes the sessions to the other FortiGate-7121F. You can log into peer_1 and make configuration changes, which are synchronized to peer_2.