Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Hyperscale Firewall Guide

Basic FGSP HA hardware session synchronization configuration example

The following steps describe how to set up a basic FGSP configuration to provide FGSP HA hardware session synchronization between one or more hyperscale firewall VDOMs in two FortiGate peers.

Use the following steps to configure FGSP on both of the peers in the FGSP cluster.

  1. Enable FGSP for a hyperscale firewall VDOM, named MyCGN-hw12:

    config system standalone-cluster

    config cluster-peer

    edit 1

    set peerip 1.1.1.1

    set syncvd MyCGN-hw12

    end

    If your FortiGate has multiple hyperscale firewall VDOMs, you can add the names of the hyperscale VDOMs to be synchronized to the syncvd option. For example:

    config system standalone-cluster

    config cluster-peer

    edit 1

    set peerip 1.1.1.1

    set syncvd MyCGN-hw12, MyCGN-hw22

    end

    In most cases you should create only one cluster-sync instance. If you create multiple cluster-sync instances, all FGSP HA hardware session synchronization sessions will be sent to the interface used by each cluster-sync instance.

  2. Configure FGSP session synchronization as required. All session synchronization options are supported. For example:

    config system ha

    set session-pickup enable

    set session-pickup-connectionless enable

    set session-pickup-expectation enable

    set session-pickup-nat enable

    end

  3. Configure networking on the FortiGate so that traffic to be forwarded to the peer IP address (in the example, 1.1.1.1) passes through a data interface or data interface LAG.

    This data interface or data interface LAG becomes the FGSP HA hardware session synchronization interface. If the data interface or data interface LAG is in the root VDOM, no additional configuration is required.

    If the data interface or data interface LAG is not in the root VDOM, you need to use the peervd option to specify the VDOM that the interface is in. For example, if the data interface or data interface LAG is in the MyCGN-hw12 VDOM:

    config system standalone-cluster

    config cluster-peer

    edit 1

    set peerip 1.1.1.1

    set syncvd MyCGN-hw12, MyCGN-hw22

    set peervd MyCGN-hw12

    end

Basic FGSP HA hardware session synchronization configuration example

The following steps describe how to set up a basic FGSP configuration to provide FGSP HA hardware session synchronization between one or more hyperscale firewall VDOMs in two FortiGate peers.

Use the following steps to configure FGSP on both of the peers in the FGSP cluster.

  1. Enable FGSP for a hyperscale firewall VDOM, named MyCGN-hw12:

    config system standalone-cluster

    config cluster-peer

    edit 1

    set peerip 1.1.1.1

    set syncvd MyCGN-hw12

    end

    If your FortiGate has multiple hyperscale firewall VDOMs, you can add the names of the hyperscale VDOMs to be synchronized to the syncvd option. For example:

    config system standalone-cluster

    config cluster-peer

    edit 1

    set peerip 1.1.1.1

    set syncvd MyCGN-hw12, MyCGN-hw22

    end

    In most cases you should create only one cluster-sync instance. If you create multiple cluster-sync instances, all FGSP HA hardware session synchronization sessions will be sent to the interface used by each cluster-sync instance.

  2. Configure FGSP session synchronization as required. All session synchronization options are supported. For example:

    config system ha

    set session-pickup enable

    set session-pickup-connectionless enable

    set session-pickup-expectation enable

    set session-pickup-nat enable

    end

  3. Configure networking on the FortiGate so that traffic to be forwarded to the peer IP address (in the example, 1.1.1.1) passes through a data interface or data interface LAG.

    This data interface or data interface LAG becomes the FGSP HA hardware session synchronization interface. If the data interface or data interface LAG is in the root VDOM, no additional configuration is required.

    If the data interface or data interface LAG is not in the root VDOM, you need to use the peervd option to specify the VDOM that the interface is in. For example, if the data interface or data interface LAG is in the MyCGN-hw12 VDOM:

    config system standalone-cluster

    config cluster-peer

    edit 1

    set peerip 1.1.1.1

    set syncvd MyCGN-hw12, MyCGN-hw22

    set peervd MyCGN-hw12

    end