Configuring the OCI HA interfaces

OCI recommends leaving VM NIC interfaces set to DHCP. This is to avoid potential misaligned configurations. However, when configuring an NVA, you may need to ignore this recommendation. When doing so, ensure that the IP addresses correspond with those intended, so that to the extent required, the configurations match.

In the case of HA, it is necessary that the FortiGate-VMs have the correct IP information statically configured in order to provide proper failover between the two devices.

OCI API calls enable the failover mentioned above through the OCI Fabric connector, but only for IP addresses configured as secondary in the OCI VNIC configuration.

Also, OCI API calls, if initiated from within a VCN, must be made by a primary interface with a public address. Thus, the network configuration for OCI HA will be unique and very specific.

You may lose connection to the instance during interface IP address and route configuration. It is therefore recommended to perform this configuration via the console.

Primary FortiGate

port1

The primary VNIC associated with the FortiGate NVA must have a primary IP address with a corresponding public IP address configured in a public subnet. This will be used as a management interface and also the interface from which API calls are made (this will be assigned in the HA configuration). See this interface's OCI configuration, then the corresponding FortiGate-VM configuration.

config system interface

edit "port1"

set vdom "root"

set ip 10.0.13.3 255.255.255.0

set allowaccess ping https ssh http fgfm

set description "management"

set mtu-override enable

set mtu 9000

end

port2

In this example, port2 is assumed to be a public/WAN-facing interface. The following FortiGate configuration does not use the primary IP address for its interface IP address. Instead, it uses the non-primary private IP address, as shown. This is because the primary IP address is not relocatable to the secondary FortiGate in the event of HA failover. In this example, the FortiGate uses only a single secondary IP address with an associated public IP address. In the case of a failover, the secondary IP address and associated public IP address are migrated from the active to the passive FortiGate. Therefore, if any extra non-primary private IP addresses are used in the setup, these IP addresses must be referenced explicitly in the interface configuration by enabling secondary IP addresses.

config system interface

edit "port2"

set vdom "root"

set ip 10.0.12.5 255.255.255.0

set allowaccess ping https ssh fgfm

set description "untrust"

set secondary-IP enable

set mtu-override enable

set mtu 9000

config secondaryip

edit 1

set ip 10.0.12.6 255.255.255.0

set allowaccess ping https ssh fgfm

end

port3

This example configures port3 as the internal port, which is used to connect to internal resources on local subnets, peered VCNs, and so on. However, as mentioned earlier, FortiGate does not use the primary IP address.

config system interface

edit "port3"

set vdom "root"

set ip 10.0.8.10 255.255.255.0

set allowaccess ping https ssh fgfm

set description "trusted"

set mtu-override enable

set mtu 9000

end

port4

This example uses port4 as the HA interface for heartbeat and configuration synchronization. As such, it only needs a single private IP address.

config system interface

edit "port4"

set vdom "root"

set ip 10.0.10.3 255.255.255.0

set allowaccess ping https ssh fgfm

set description "heartbeat"

set mtu-override enable

set mtu 9000

end