Skip to main content
kumarh
Staff
kumarh
Staff
November 18, 2024

Troubleshooting Tip: FGSP recv_err Counter Increasing in FortiGate Clusters

  • November 18, 2024
  • 0 replies
  • 489 views
Description

This article describes how to address an issue where the FGSP recv_err counter increases in FortiGate clusters, which may indicate session synchronization errors. Although the increase in this counter may not immediately affect cluster performance, prolonged errors could lead to stability concerns.

 

This issue can impact session synchronization in clustered environments.
Scope FortiGate.
Solution

To check the FGSP recv_err, it is possible to run the following command:

diagnose sys session sync

 

sync_ctx: sync_started=1, sync_tcp=1, sync_others=1,
sync_expectation=1, sync_nat=1, stdalone_sesync=1.
sync: create=2984287144:1822781351, update=766071495, delete=388955745:30323655, query=1573512550
recv: create=1490107562:3502980314, update=1488235433, delete=2618142462:28283218, query=4009723522
ses pkts: send=1900832066, alloc_fail=0, recv=3366892477, recv_err=598764316, sz_err=0, ses_convert_err=0
udp pkts: send=679, recv=231061
nCfg_sess_sync_num=5, mtu=1500, ipsec_tun_sync=1

 

To resolve the issue of increasing FGSP recv_err counters, configure identical session-sync-dev interfaces for all FortiGate members in the FGSP cluster.

This ensures proper session synchronization, which will prevent the counter from increasing without causing an impact on traffic or session management.

 

Configure identical session-sync-dev interfaces by running the following commands:

 

config system standalone-cluster
    set session-sync-dev "<interface 1>" " interface 2"
end

 

It is required to use the same interface for session-sync-dev:

For example, if two FortiGates are in the FGSP cluster, then configure them like this:


In FortiGate A:

 

config system standalone-cluster
    set session-sync-dev "port1" "port2"

 

In FortiGate B:

 

config system standalone-cluster
    set session-sync-dev "port1" "port2"

 

For the conditions of use of the above command, check the article below:

Technical Tip: FortiGate HA Heartbeat packet Ethertypes

 

Note:

When FGSP peers are formed between standalone FortiGates, the session synchronization process is performed by the kernel with UDP encapsulation. When using an FGSP session synchronization interface, the synchronization process is also offloaded to the kernel, albeit more efficiently without the UDP encapsulation.

 

Therefore, a fast, dedicated, and stable L2 connection is recommended for the session synchronization interface between the FGSP peers. For redundancy, multiple synchronization interfaces can be configured. The session synchronization interface or interfaces should always be the same on each FGSP peer.

 

Related articles:
Technical Tip: HA session-sync-dev configuration

Technical Tip: Suggested Parameters to use for a FortiGate Session Life Support Protocol (FGSP) cluster

 

    Terms & ConditionsAccessibility statement