Fortinet Document Library

Version:

Version:

Version:


Table of Contents

New Features

Download PDF
Copy Link

Liveness detection support for VMware NSX-T service 6.4.4

The Liveness Detection feature may be used to force the VMware NSX-T service to not use a specific FortiGate device until its service managing FortiManager updates the FortiGate configuration. This is expected to be a common requirement when, for example, new FortiGates are deployed. If this is desired, the newly deployed FortiGates should not reply to liveness detection queries or forward any traffic until they have received sufficient configuration data from their service managing FortiManager. The VMware NSX-T service will use other already-configured FortiGates instead, if any are available.

When configuring a service from FortiManager to VMware NSX-T, you may set the Enable Liveness Detection setting to ON or OFF. The setting is ON by default.

To configure a VMware NSX-T service with Liveness Detection:
  1. Register a service from FortiManager to VMware NSX-T. See To register a service from FortiManager to VMware NSX-T on the Creating VMware NSX-T connector page of the FortiManager 6.4.4 Admin Guide.
  2. Deploy a FortiGate VM from VMware NSX-T and enable central management. See To deploy a FortiGate VM from VMware NSX-T and enable central management on the Creating VMware NSX-T connector page of the FortiManager 6.4.4 Admin Guide.
  3. Add the service chain and configure the Liveness Detection setting:
    1. On the FortiManager GUI, go to Policy & Objects > Object Configurations > Fabric Connectors > Endpoint/Identity and select the added NSX-T service.
    2. Right-click on the selected service and click Configure. The Configure Devices of NSX-T Service dialog appears.
    3. Select the FortiGate device listed in the table and click Add. The Add Service Chain dialog appears.

    4. Toggle the Enable Liveness Detection setting to ON. It is set to ON by default.
    5. Select the appropriate options for the Service Profile and Service Chain fields as required from the drop-down lists.
    6. Click OK.
  4. Configure Liveness Detection and service chain configurations on FortiGate from the CLI:

    FortiGate-VM64 # conf nsxt setting

    FortiGate-VM64 (setting) # sh fu

    config nsxt setting

    set liveness disable

    set service "<name>"

    end

    FortiGate-VM64 (setting) # set liveness enable

    FortiGate-VM64 (setting) # end

    FortiGate-VM64 #

    FortiGate-VM64 (5) # sh

    config nsxt service-chain

    edit 5

    config service-index

    edit 1

    set vd "root"

    next

    end

    next

    end

    FortiGate-VM64 (5) # end

  5. Check Liveness Detection and service chain configurations on FortiManager:
    1. Go to Policy & Objects > Object Configurations > Fabric Connectors > Endpoint/Identity and select the added NSX-T service.
    2. Right-click on the selected service and click Configure. The Configure Devices of NSX-T Service dialog appears. The Liveness Detection column indicates that the setting is Enabled.

  6. Configure a virtual wire pair interface and a virtual wire pair policy and install to FortiGate. See To complete the fabric connector setup on the Creating VMware NSX-T connector page of the FortiManager 6.4.4 Admin Guide.

Liveness detection support for VMware NSX-T service 6.4.4

The Liveness Detection feature may be used to force the VMware NSX-T service to not use a specific FortiGate device until its service managing FortiManager updates the FortiGate configuration. This is expected to be a common requirement when, for example, new FortiGates are deployed. If this is desired, the newly deployed FortiGates should not reply to liveness detection queries or forward any traffic until they have received sufficient configuration data from their service managing FortiManager. The VMware NSX-T service will use other already-configured FortiGates instead, if any are available.

When configuring a service from FortiManager to VMware NSX-T, you may set the Enable Liveness Detection setting to ON or OFF. The setting is ON by default.

To configure a VMware NSX-T service with Liveness Detection:
  1. Register a service from FortiManager to VMware NSX-T. See To register a service from FortiManager to VMware NSX-T on the Creating VMware NSX-T connector page of the FortiManager 6.4.4 Admin Guide.
  2. Deploy a FortiGate VM from VMware NSX-T and enable central management. See To deploy a FortiGate VM from VMware NSX-T and enable central management on the Creating VMware NSX-T connector page of the FortiManager 6.4.4 Admin Guide.
  3. Add the service chain and configure the Liveness Detection setting:
    1. On the FortiManager GUI, go to Policy & Objects > Object Configurations > Fabric Connectors > Endpoint/Identity and select the added NSX-T service.
    2. Right-click on the selected service and click Configure. The Configure Devices of NSX-T Service dialog appears.
    3. Select the FortiGate device listed in the table and click Add. The Add Service Chain dialog appears.

    4. Toggle the Enable Liveness Detection setting to ON. It is set to ON by default.
    5. Select the appropriate options for the Service Profile and Service Chain fields as required from the drop-down lists.
    6. Click OK.
  4. Configure Liveness Detection and service chain configurations on FortiGate from the CLI:

    FortiGate-VM64 # conf nsxt setting

    FortiGate-VM64 (setting) # sh fu

    config nsxt setting

    set liveness disable

    set service "<name>"

    end

    FortiGate-VM64 (setting) # set liveness enable

    FortiGate-VM64 (setting) # end

    FortiGate-VM64 #

    FortiGate-VM64 (5) # sh

    config nsxt service-chain

    edit 5

    config service-index

    edit 1

    set vd "root"

    next

    end

    next

    end

    FortiGate-VM64 (5) # end

  5. Check Liveness Detection and service chain configurations on FortiManager:
    1. Go to Policy & Objects > Object Configurations > Fabric Connectors > Endpoint/Identity and select the added NSX-T service.
    2. Right-click on the selected service and click Configure. The Configure Devices of NSX-T Service dialog appears. The Liveness Detection column indicates that the setting is Enabled.

  6. Configure a virtual wire pair interface and a virtual wire pair policy and install to FortiGate. See To complete the fabric connector setup on the Creating VMware NSX-T connector page of the FortiManager 6.4.4 Admin Guide.