Configuring FGCP HA hardware session synchronization
Use the following command to configure hyperscale FGCP HA hardware session synchronization.
config system ha
set session-pickup enable
set hw-session-sync-dev <interface>
end
session-pickup must be enabled for FGCP HA hardware session synchronization.
hw-session-sync-dev select one or more interfaces to use to synchronize hardware sessions between the FortiGates in an FGCP cluster. You can select one or more physical interfaces. You can also select a single LAG. You can also select both a single LAG and one or more physical interfaces.
The physical interfaces can also be session-sync-dev interfaces. However, using the same interface for hardware and software session synchronization is not recommended and can result in some sessions not being synchronized.
See also, Recommended interface use for an FGCP HA hyperscale firewall cluster.
Use the following configuration to create a data interface LAG. The members of the LAG can be any data interfaces that can be added to LAGs as supported by your FortiGate model.
config system interface
edit HA-session-lag
set type aggregate
set member port13 port14 port15 port16
set lacp-mode static
end
|
You can only use a static mode LAG as the hardware session synchronization interface ( |
Use the following command to set the LAG and two physical interfaces as FGCP HA hardware session synchronization interfaces.
config system ha
set session-pickup enable
set hw-session-sync-dev HA-session-lag port10 port11
end
For the FortiGate 1800F and 1801F, you can only use the port25 to port40 interfaces as FGCP HA hardware session synchronization interfaces. Also on the FortiGate 1800F and 1801F, you can't use a LAG interface as the hardware session synchronization interface if the LAG includes interfaces that can't be used for hardware session synchronization.
Hardware session synchronization can use a lot of bandwidth so you should use a dedicated data interface or data interface LAG. Both FortiGates in the FGCP HA cluster must use the same data interface or data interface LAG for FGCP HA hardware session synchronization and these interfaces must be directly connected.