Fortinet Document Library

Version:

Version:


Table of Contents

Cookbook

Download PDF
Copy Link

FGSP (session synchronization) peer setup

The FortiGate Session Life Support Protocol (FGSP) is a proprietary HA solution for only sharing sessions between two entities and is based on a peer-to-peer structure. The entities could be standalone FortiGates or an FGCP cluster.

Connect all necessary interfaces as per the topology diagram below. Interfaces may be changed depending on the models in use. Interface names in the topology diagram are for example purposes only.

To setup an FGSP peer through the CLI:

These instructions assume that the device has been connected to the console, the CLI is accessible, and that all FortiGates have been factory reset.

  1. Connect all necessary interfaces as per the topology diagram.
  2. Enter the following command to change the FortiGate unit host name:
    config system global
        set hostname Example1_host(Example2_host, etc)
    end
  3. On each FGSP peer device, enter the following command:
    config system cluster-sync
       set peerip xx.xx.xx.xx    --->> peer's interface IP for session info to be passed.
    end 
  4. Set up identical firewall policies.
    FGSP peers share the same session information which goes from the same incoming interface (example: port1) to the outgoing interface (example: port2). Firewall policies should be identical as well, and can be copied from one device to its peer.
To test the setup:
  1. Initiate TCP traffic (like HTTP access) to go through FortiGateA.
  2. Check the session information.
    Example: diag sys session filter src xx.xx.xx.xx (your PCs IP) diag sys session lsit.
  3. Use the same command on FortiGateB to determine if the same session information appeared.

FGSP (session synchronization) peer setup

The FortiGate Session Life Support Protocol (FGSP) is a proprietary HA solution for only sharing sessions between two entities and is based on a peer-to-peer structure. The entities could be standalone FortiGates or an FGCP cluster.

Connect all necessary interfaces as per the topology diagram below. Interfaces may be changed depending on the models in use. Interface names in the topology diagram are for example purposes only.

To setup an FGSP peer through the CLI:

These instructions assume that the device has been connected to the console, the CLI is accessible, and that all FortiGates have been factory reset.

  1. Connect all necessary interfaces as per the topology diagram.
  2. Enter the following command to change the FortiGate unit host name:
    config system global
        set hostname Example1_host(Example2_host, etc)
    end
  3. On each FGSP peer device, enter the following command:
    config system cluster-sync
       set peerip xx.xx.xx.xx    --->> peer's interface IP for session info to be passed.
    end 
  4. Set up identical firewall policies.
    FGSP peers share the same session information which goes from the same incoming interface (example: port1) to the outgoing interface (example: port2). Firewall policies should be identical as well, and can be copied from one device to its peer.
To test the setup:
  1. Initiate TCP traffic (like HTTP access) to go through FortiGateA.
  2. Check the session information.
    Example: diag sys session filter src xx.xx.xx.xx (your PCs IP) diag sys session lsit.
  3. Use the same command on FortiGateB to determine if the same session information appeared.