Configuring FGCP HA hardware session synchronization

Use the following command to configure FGCP HA hardware session synchronization.

config system ha

set session-pickup enable

set hw-session-sync-dev <interface>

end

session-pickup must be enabled for FGCP HA hardware session synchronization.

hw-session-sync-dev select an interface to use to synchronize hardware sessions between the FortiGates in an FGCP cluster. Fortinet recommends using a data interface or a data interface LAG as the FGCP HA hardware session synchronization interface. The interface or LAG can only be used for FGCP HA hardware session synchronization. See Recommended interface use for an FGCP HA hyperscale firewall cluster.

Use the following configuration to create a data interface LAG. The members of the LAG can be any data interfaces that can be added to LAGs as supported by your FortiGate model.

config system interface

edit HA-session-lag

set type aggregate

set member port13 port14 port15 port16

set lacp-mode static

end

You can only use a static mode LAG as the hardware session synchronization interface (lacp-mode must be set to static).

Use the following command to set the LAG as the FGCP HA hardware session synchronization interface.

config system ha

set session-pickup enable

set hw-session-sync-dev HA-session-lag

end

Some FortiGate models restrict the interfaces you can use as HA hardware session synchronization interfaces. In all cases, you can't use a LAG interface as the hardware session synchronization interface if the LAG includes interfaces that can't be used for hardware session synchronization. Here are some examples:

• For the FortiGate 1800F and 1801F, you can only use the ha1, ha2, and port25 to port40 interfaces as FGCP HA hardware session synchronization interfaces.

• For the FortiGate 2600F and 2601F, you can't use the ha1 and ha2 interfaces as FGCP HA hardware session synchronization interfaces.

• For the FortiGate 3000F and 3001F, you can't use the ha1 and ha2 interfaces as FGCP HA hardware session synchronization interfaces.

If you attempt to add an unsupported interface or an unsupported LAG, the CLI will accept the change but when you type end to save your changes the CLI displays an error message similar to the following:

# set hw-session-sync-dev port18
# end
Failed to setup HA: RLT link interface port18, purge delay 150, hold time 10
object set operator error, -651, roll back the setting
Command fail. Return code -651 

To resolve this issue you need to set hw-session-sync-dev to a supported interface or LAG and then restart the HA cluster. Changing the configuration without restarting does not resolve the issue.

Hardware session synchronization can use a lot of bandwidth so you should use a dedicated data interface or data interface LAG. Both FortiGates in the FGCP HA cluster must use the same data interface or data interface LAG for FGCP HA hardware session synchronization and these interfaces must be directly connected.