Support for route monitoring to FGSP peer 7.6.1

This information is also available in the FortiOS 7.6 Administration Guide: Route monitoring to FGSP peer

Route monitoring to FGSP is available, enhancing network stability by detecting route prefix withdrawals. This prevents black holing in complex environments and improves the UTM scanning experience.

Previously, FGSP managed asymmetric traffic by active peers when the original peer was unavailable or unhealthy due to monitored interface or ping-server monitor failures. Now, it also uses route monitoring to share the not-ready status over FGSP heartbeats, ensuring traffic isn’t redirected to the unhealthy peer. For more information, see FGSP support for failover with asymmetric traffic and UTM.

This enhancement ensures continuity and reliability of the network sessions, even if a device does not function as expected.

There are new configuration options available in the config system standalone-cluster command in the CLI:

config system standalone-cluster
    config monitor-prefix
        edit <ID>
            set vdom <VDOM name>
            set vrf <VRF ID>
            set prefix <ip address and netmask>
        next
    end
end

Example

In the following configurations, two peers are configured in FGSP, and a list of routing prefixes to monitor are configured.

To configure route monitoring to FGSP:

1. Configure two peers in FGSP:

   config system standalone-cluster
       set standalone-group-id 1
       config cluster-peer
           edit 1
               set peerip 10.2.2.2
           next
       end
       config monitor-prefix 
           edit 1
               set vdom "root"
               set prefix 192.168.2.0 255.255.255.0
           next
           edit 2
               set vdom "root"
               set prefix 20.1.1.0 255.255.255.0
           next
       end
   end

2. Verify the health status on peer_1:

   #diagnose test application sessionsync 1
   HA is not enabled
   sync context:
           sync-enabled=0, sync-tcp=1, sync-nat=0
           sync-other=1, sync-exp=1, standalone-sync=1, mtu=0
           ipsec-tun-sync=1, encrypt-enabled=0
   fgsp-peers-num=1, kernel-filters-num=1
   fgsp-peers:
           vdom=0, ip/port=10.2.2.2:708
   fgsp_route_health=1
           mon_prefix: vdom=root vrf=0, prefix=192.168.2.0(255.255.255.0) healthy=1
           mon_prefix: vdom=root vrf=0, prefix=20.1.1.0(255.255.255.0) healthy=1

   Traffic originally passes through UTM inspection over peer_1. The return traffic is routed to peer_2, where it will bounce to peer_1, the original FGSP peer for inspection.

   When the routing prefix becomes unavailable, the health status immediately changes to unhealthy.

   #diag test application sessionsync 1
   HA is not enabled
   sync context:
           sync-enabled=0, sync-tcp=1, sync-nat=0
           sync-other=1, sync-exp=1, standalone-sync=1, mtu=0
           ipsec-tun-sync=1, encrypt-enabled=0
   fgsp-peers-num=1, kernel-filters-num=1
   fgsp-peers:
           vdom=0, ip/port=10.2.2.2:708
   fgsp_route_health=0
           mon_prefix: vdom=root vrf=0, prefix=192.168.2.0(255.255.255.0) healthy=1
           mon_prefix: vdom=root vrf=0, prefix=20.1.1.0(255.255.255.0) healthy=0

   Upon peer_1 becoming unavailable or unhealthy, traffic no longer bounces back to peer_1. Instead, it is failed over to peer_2 for processing.