Skip to main content
Haggai
New Member
August 20, 2018
Question

Syncing configuration to DR site

  • August 20, 2018
  • 3 replies
  • 6449 views
Hello

On primary site we have an HA cluster.

On DR site a different hardware (same FortiOS version) exists, connected to the network without external interfaces on normal status.

How can we auto sync the config to the DR?

 

Thank you

    3 replies

    emnoc
    New Member
    August 21, 2018

    Not possible , what you can do is set  a scripts to copy out the  objects and copy the object out to the 2nd  DR cluster. This is easy todo if you standardize the  networks

     

    e.g

     

    MAIN-cluster

     

    1.1.1.1   MAINHOST01

    1.1.1.2   MAINHOST02

    1.1.1.3   MAINHOST03

     

    2.1.1.1   DRHOST01

    2.1.1.2   DRHOST02

    2.1.1.3   DRHOST03

     

    Now what we do  is take a unix script to sed and replace  MAIN to DR and the network space and then copy the objects out to the DR.

     

    Now when we activate the DR  they plumb the 2.1.1.1 2.1.1.2 and 2.1.1.3 devices in VMware and as a symmetrical configuration that matches the main-site

     

    Alexis_G
    New Member
    August 21, 2018

    If you have minor differences in hardware you can form HA according to below refernece:

    http://kb.fortinet.com/kb/viewContent.do?externalId=FD35376&sliceId=1

     

    otherwise you need to move the subordinary member to DR site,

    I generally for these decisions you need more info. Like:

    The DR is it cold site or hot site ?

    Do you have L2 connectivity between PRI and DR site ?

    Do you have bandwidth ?

     

     

     

    Haggai
    HaggaiAuthor
    New Member
    August 21, 2018

    jklapas wrote:

    If you have minor differences in hardware you can form HA according to below refernece:

    http://kb.fortinet.com/kb/viewContent.do?externalId=FD35376&sliceId=1

     

    otherwise you need to move the subordinary member to DR site,

    I generally for these decisions you need more info. Like:

    The DR is it cold site or hot site ?

    Do you have L2 connectivity between PRI and DR site ?

    Do you have bandwidth ?

     

     

     

    Due to different hardware it is not part of the cluster.

    Cold DR site.

    Connectivity between sites L2 based.

    No bandwidth limitations.

    sw2090
    SuperUser
    SuperUser
    August 21, 2018

    what you could do is enable admin-scp on cli and then get the config of the cluster via scp. HOwever even if the other FGT run the same FortiOS Version they may have different port layout or names etc so in most of the cases the config will not run without editing it.