FGSP CLI command name changed
The FortiOS 5.2 command config system session-sync has been changed in FortiOS 5.4 to config system cluster-sync. Otherwise the command syntax is the same and the config system ha commands used for FGSP settings have not changed.
HA heartbeat traffic set to the same priority level as data traffic
Local out traffic, including HA heartbeat traffic, is now set to high priority to make sure it is processed at the same priority level as data traffic. This change has been made because HA heartbeat traffic can be processed by NP6 processors that are also processing data traffic. When HA heartbeat traffic was set to a lower priority it may have be delayed or dropped by very busy NP6 processors resulting in HA failovers.
Firewall local-in policies are supported for the dedicated HA management interface
To add local in polices for the dedicated management interface, enable ha-mgmt-inft-only and set intf to any. Enabling ha-mgmt-intf-only means the local-in policy applies only to the VDOM that contains the dedicated HA management interface.
config firewall local-in-policy
edit 0
set ha-mgmt-intf-only enable
set intf any
etc…
end
If you were one of those people, like me, that would have application control sessions blocked after a failover on HA then 5.4 may be beneficial for you! See below!
VOIP application control sessions are no longer blocked after an HA failover (273544)
After an HA failover, VoIP sessions that are being scanned by application control will now continue with only a minor interruption, if any. To support this feature, IPS UDP expectation tables are now synchronized between cluster units
FRUP is not supported by FortiOS 5.4
With the changes to switch mode, FRUP is no longer available on the FortiGate-100D
FGCP supports BFD enabled BGP graceful restart after an HA failover
If an HA cluster is part of a Border Gateway Protocol (BGP) bidirectional forwarding detection (BFD) configuration where both the cluster and the BGP static neighbor are configured for graceful restart, after an HA failover BGP enters graceful restart mode and both the cluster and the BGP neighbor keep their BGP routes.
To support HA and BFD enabled BGP graceful:
So I went through my FortiGate and created a guest wireless for my PC Troubleshooting little side business. The last thing I want is their malware infested machines giving my home or work computers the crud. I also took this time to jump in and get my DMZ setup for my webserver that I am going to host off my business line.
Those of you that remember, I have 2 internet connections coming into my FortiGate 92D. I have a charter personal line that gives me 135/5 (man I wish they could get that upload up) and a business line with static IP through charter as well that gives me 100/7 (again, I need more upload ugh).
Either way, things are going swimmingly. I’m going to make some videos to help get my home network more up to par and to explain and show what I am doing. I figured you would like something like that.
I just wanted to provide that little tid bit of information. I will eventually provide a VISIO of my network at the house (sanitized of course).
So, a lot of people are starting to deploy HA clusters of Fortinet hardware which is awesome. There are however some things you will want to consider before doing so. Here is a drill down from the Fortinet HA for FortiOS 5.4 Administration document.
Before you begin
Before you begin using this guide, take a moment to note the following:
Many of the configuration examples in this document begin FortiGates unit configured with the factory default configuration. This is optional, but may make the examples easier to follow. As well, you do not need to have installed the FortiGate units on your network before using the examples in this document.
Before you set up a cluster
Before you set up a cluster ask yourself the following questions about the FortiGate units that you are planning to use to create a cluster. Do all the FortiGate units have the same hardware configuration? Including the same hard disk configuration and the same optional components installed in the same slots?
1. Do all FortiGate units have the same firmware build?
2. Are all FortiGate units set to the same operating mode (NAT or Transparent)?
3. Are all the FortiGate units operating in the same VDOM mode?
4. If the FortiGate units are operating in multiple VDOM mode do they all have the same VDOM configuration?