Configuration

You use the following command to configure an FGSP cluster-sync instance:

config system cluster-sync

edit 1

set peerip <peer-ip-address>

set peervd <vdom-name>

set syncvd <vdom-name>

end

Where:

• peerip is the IP address of an interface of another FortiGate in the FGSP deployment that this configuration synchronizes sessions to.
• peervd the name of the virtual domain that contains the session synchronization link interface on the peer unit. Usually both peers would have the same peervd. Multiple session synchronization configurations can use the same peervd. The default VDOM name is root.
• syncvd is the name of one or more VDOMs that should be synchronized by this cluster-sync instance. If multiple VDOMs are not enabled, syncvd should be set to root, which is the default setting.

For FGSP to work properly, all VDOMs to be synchronized must be added to all of the FortiGates in the deployment. The names of the matching interfaces in each VDOM must also be the same; this includes the names of matching VLAN interfaces. Note that the index numbers of the matching interfaces and VLAN interfaces can be different. Also the VLAN IDs of the matching VLAN interfaces can be different. If you enable configuration synchronization this will happen automatically.

This command creates a cluster-sync instance that causes a FortiGate to synchronize the TCP sessions of one of its VDOMs (by default the root VDOM) to the root VDOM of another FortiGate (which would become another FortiGate in the FGSP deployment). You can also use the config system ha command to synchronize more session types. Cluster-sync instances are not synchronized and must be added to each FortiGate in the deployment.

A deployment of two FortiGates would only require one cluster-sync instance for each VDOM to be synchronized. This instance would synchronize the sessions from the root VDOM of one FortiGate to the root VDOM of the other. The second FortiGate would also include a cluster-sync instance to synchronize its root VDOM with the root VDOM of the other FortiGate.

In a multiple VDOM configuration, you add a separate cluster-sync instance for each VDOM to be synchronized. You don’t have to synchronize all VDOMs. If multiple VDOMs are enabled, the config system cluster-sync command is a global command.

FGSP deployments with three or more FortiGates

If an FGSP deployment includes three or more FortiGates, you must explicitly define all of the cluster-sync instances that you need. In a deployment of four FortiGates, each FortiGate can synchronized with up to three other FortiGates. So, to synchronize all of the FortiGates, you must add three cluster-sync instances to each FortiGate (or n-1, where n is the number of FortiGates in the deployment).

Selecting the sessions to synchronize

You can add a cluster-sync instance with a filter to only synchronize some sessions. A filter can be added to a cluster-sync instance as follows:

config system cluster-sync

edit 1

set peerip <peer-ip-address>

set peervd <vdom-name>

set syncvd <vdom-name>

config session-sync-filter

srcintf <interface-name>

dstintf <interface-name>

srcaddr x.x.x.x x.x.x.x

dstaddr x.x.x.x x.x.x.x

srcaddr6 ::/x

dstaddr6 ::/x

end

end

You can use the filter to only synchronize sessions according to the session source and destination interface and IPv4 or IPv6 address.

You can only add one filter to a cluster-sync instance. To create multiple filters you must create multiple cluster-sync instances.