Configuring FGCP HA hardware session synchronization

Use the following command to configure hyperscale FGCP HA hardware session synchronization.

config system ha

set session-pickup enable

set hw-session-sync-dev <interface>

end

session-pickup must be enabled for FGCP HA hardware session synchronization.

hw-session-sync-dev select one or more interfaces to use to synchronize hardware sessions between the FortiGates in an FGCP cluster. You can select one or more physical interfaces. You can also select a single LAG. You can also select both a single LAG and one or more physical interfaces.

The physical interfaces can also be session-sync-dev interfaces. However, using the same interface for hardware and software session synchronization is not recommended and can result in some sessions not being synchronized.

See also, Recommended interface use for an FGCP HA hyperscale firewall cluster.

Use the following configuration to create a data interface LAG. The members of the LAG can be any data interfaces that can be added to LAGs as supported by your FortiGate model.

config system interface

edit HA-session-lag

set type aggregate

set member port13 port14 port15 port16

set lacp-mode static

end

You can only use a static mode LAG as the hardware session synchronization interface (lacp-mode must be set to static).

Use the following command to set the LAG and two physical interfaces as FGCP HA hardware session synchronization interfaces.

config system ha

set session-pickup enable

set hw-session-sync-dev HA-session-lag port10 port11

end

Some FortiGate models restrict the interfaces you can use as HA hardware session synchronization interfaces. In all cases, you can't use a LAG interface as the hardware session synchronization interface if the LAG includes interfaces that can't be used for hardware session synchronization. Here are some examples:

• For the FortiGate 1800F and 1801F, you can only use the ha1, ha2, and port25 to port40 interfaces as FGCP HA hardware session synchronization interfaces.

• For the FortiGate 2600F and 2601F, you can't use the ha1 and ha2 interfaces as FGCP HA hardware session synchronization interfaces.

• For the FortiGate 3000F and 3001F, you can't use the ha1 and ha2 interfaces as FGCP HA hardware session synchronization interfaces.

If you attempt to add an unsupported interface or an unsupported LAG, the CLI displays an error message.

Hardware session synchronization can use a lot of bandwidth so you should use a dedicated data interface or data interface LAG. Both FortiGates in the FGCP HA cluster must use the same data interface or data interface LAG for FGCP HA hardware session synchronization and these interfaces must be directly connected.