Technical Tip: HA session-sync-dev configuration

[cborgato_FTNT]

Description

This article describes the benefits of configuring a dedicated session-sync-dev in an HA (High Availability) FortiGate Cluster, especially in situations where the exchange of session synchronization information is high.

Using the session-sync-dev option it is possible to select one or more FortiGate interfaces to use for synchronizing sessions as required for session pickup. Normally session synchronization occurs over the HA heartbeat link.

Moving session synchronization from the HA heartbeat interface reduces the bandwidth requirements of the HA heartbeat interface and may improve the efficiency and performance of the cluster, especially if the cluster is synchronizing a large number of sessions. Load balancing session synchronization among multiple interfaces can further improve performance and efficiency if the cluster is synchronizing a large number of sessions.

Key factors to consider when deciding to use session-sync-dev in FortiGate configuration include:

1. High Session Synchronization Requirements.
2. Telco/ISP Environments.
3.  Enhanced Fault Tolerance.
4.  Load Balancing.
5.  Scalability Requirements.
6.  Redundancy Needs.
7.  Mission-Critical Applications.

Scope

FortiGate.

Solution

session-sync-dev means only the selected interfaces are used for session synchronization and not the HA heartbeat link. Selecting more than one interface, session synchronization traffic is load balanced among the selected interfaces.

Use the following command to perform cluster session synchronization using the port10 and port12 interfaces:

config system ha
    set session-sync-dev port10 port12
end

Session synchronization packets use Ethertype 0x8892. The interfaces to use for session synchronization must be connected together either directly using the appropriate cable (possible if there are only two units in the cluster) or using switches. If one of the interfaces becomes disconnected the cluster uses the remaining interfaces for session synchronization. If all of the session synchronization interfaces become disconnected, session synchronization reverts to using the HA heartbeat link. All session synchronization traffic is between the primary unit and each subordinate unit.

Related articles:

Technical Note: Sessions synchronization

Technical Note: How to increase session-sync performance on a SLBC cluster