Skip to main content
xwiz
xwiz
New Member
May 14, 2020
Question

ACL synchronization between two Fortigate clusters

  • May 14, 2020
  • 2 replies
  • 4904 views

Hello!

I need to synchronization ACL between two Fortigate clusters. They are installed on the edge of my network. Does fortigate have such features?

 

I could do this by combining two clusters into one consisting of 4 Fortigate. But I have different models Fortigate: 2 Fortigate 600 D and 2 Fortigate 501 E. Can I combine them? How to do this?

 

    2 replies

    DirkDuesentrieb
    DirkDuesentrieb
    New Member
    May 15, 2020

    Hi,

    best way imho is to do it with FortiManager. This way you can

    [ul]
  • have one policy that you assign to multiple devices/clusters.
  • handle exceptions where you apply individual rules to only one cluster
  • create site specific objects with the same name but different IPs on the clusters[/ul]

    If you know CheckPoint you'll see similarities.

     

    We created a desaster recovery design with this. The DR site has a smaller FortiGate and different management and public networks, but the VM IPs are the same.

     

    Hope that helps,

     

    Dirk

    • emnoc
    emnoc
    New Member
    May 15, 2020

    options

     

    [ul]
  • API
  • automation tools ( ansible, expect, naplam)
  • or put the policy in a script and upload the script[/ul]

    We do a combination of all of these from above and use "zone-interface for name" in the policy to get around difference in port names between different hardware if we change anything out.

     

    e.g

     

    instead of port1 port2 or lan we use zones 

     

    INTERNET

    DMZ

    INTERNAL

     

    We manage like 8 different DR sites, that's  scattered thru the world by using this approach and we are lazy so each rule has all other  subnets in a address-group for simplification outside of the SNAT and VIP  the internal are 100% identical.

     

    So DMZ_LAN for SITE1  has  a address-group named DMZ but has the primary and DR subnets in that group. We copy the same group to Primary and DR site firewall. We also have the same policy-#s inused between the site ( we manually set policy # for this ) 

     

    So site1 primary policy#1192 is the same as DR #1192, make for diff and config sync to be much easier in the long run. So if you need to add a custom-service XYZ to a policy we select the policy# and added the services.

     

    We do the same with our AWS instance also, fwiw

     

    Ken Felix

     

     

     

    • poundy
    poundy
    New Member
    May 16, 2020

    I have a similar need, where I have a disjointed but similar FW in another site that has the same broad config details as the primary site. I had used scripts to sync things, and compare config exports using Notepad++ compare feature (after stripping things like UUIDs that are unique). But of late I have been using PowerShell and PowerFGT module to create policies and objects on both firewalls at the same time. 

    xwiz
    xwizAuthor
    New Member
    May 21, 2020

    up

    Terms & ConditionsAccessibility statement