Fortinet black logo

Administration Guide

UTM inspection on asymmetric traffic on L3

UTM inspection on asymmetric traffic on L3

When traffic passes asymmetrically through FGSP peers, UTM inspection can be supported by always forwarding traffic back to the session owner for processing. The session owner is the FortiGate that receives the first packet of the session.

For networks where L2 connectivity is not available, such as cloud environments, traffic bound for the session owner are forwarded through the peer interface using a UDP connection.

In this example, traffic from the internal network first hits FGT_1, but the return traffic is routed to FGT_2. Consequently, return traffic is packed and sent from FGT_2 to FGT_1 using UDP encapsulation between two peer interfaces (port 3). Traffic is then inspected by FGT_1.

To configure FTG_1:
  1. Configure the cluster, setting the peer IP to the IP address of FGT_2:
    config system cluster-sync
        edit 1
            set peerip 10.2.2.2
        next
    end
  2. Configure FGSP cluster attributes:
    config system standalone-cluster
        set standalone-group-id 1
        set group-member-id 0
        set layer2-connection unavailable
        unset session-sync-dev
    end
  3. Configure the firewall policy:
    config firewall policy
        edit 1
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable 
            set av-profile "default"
            set logtraffic all
            set nat enable
        next
    end
To configure FTG_2:
  1. Configure the cluster, setting the peer IP to the IP address of FGT_1:
    config system cluster-sync
        edit 1
            set peerip 10.2.2.1
        next
    end
  2. Configure FGSP cluster attributes:
    config system standalone-cluster
        set standalone-group-id 1
        set group-member-id 1
        set layer2-connection unavailable
        unset session-sync-dev
    end
  3. Configure the firewall policy:
    config firewall policy
        edit 1
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable 
            set av-profile "default"
            set logtraffic all
            set nat enable
        next
    end

Related Videos

sidebar video

Support UTM Inspection on Asymmetric Traffic in FGSP

  • 946 views
  • 3 years ago

More Links

UTM inspection on asymmetric traffic on L3

When traffic passes asymmetrically through FGSP peers, UTM inspection can be supported by always forwarding traffic back to the session owner for processing. The session owner is the FortiGate that receives the first packet of the session.

For networks where L2 connectivity is not available, such as cloud environments, traffic bound for the session owner are forwarded through the peer interface using a UDP connection.

In this example, traffic from the internal network first hits FGT_1, but the return traffic is routed to FGT_2. Consequently, return traffic is packed and sent from FGT_2 to FGT_1 using UDP encapsulation between two peer interfaces (port 3). Traffic is then inspected by FGT_1.

To configure FTG_1:
  1. Configure the cluster, setting the peer IP to the IP address of FGT_2:
    config system cluster-sync
        edit 1
            set peerip 10.2.2.2
        next
    end
  2. Configure FGSP cluster attributes:
    config system standalone-cluster
        set standalone-group-id 1
        set group-member-id 0
        set layer2-connection unavailable
        unset session-sync-dev
    end
  3. Configure the firewall policy:
    config firewall policy
        edit 1
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable 
            set av-profile "default"
            set logtraffic all
            set nat enable
        next
    end
To configure FTG_2:
  1. Configure the cluster, setting the peer IP to the IP address of FGT_1:
    config system cluster-sync
        edit 1
            set peerip 10.2.2.1
        next
    end
  2. Configure FGSP cluster attributes:
    config system standalone-cluster
        set standalone-group-id 1
        set group-member-id 1
        set layer2-connection unavailable
        unset session-sync-dev
    end
  3. Configure the firewall policy:
    config firewall policy
        edit 1
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable 
            set av-profile "default"
            set logtraffic all
            set nat enable
        next
    end