Technical Tip: Exclude few config to sync between HA members with 'vdom-exception'

[grg]

Description
This KB explains about excluding few config to sync between HA unit.

Solution
- When FortiGate in HA with config sync enabled, if few config needs to be exempted to sync with HA members.
- When both the FortiGate are in different availability zone (Cloud), both the FortiGate will have different subnets for each interfaces, so interface IP config should not sync with FortiGate member.
- Similarly, if any other config should be excluded from sync.
- To exclude the config to sync enable the Vdom-Exception.

CLI example to configure the Vdom-Exception.

# config sys vdom-exception
    edit < 1 – 4069>
        set object <Name>
    next
end

Below is the example to exclude the interface and Static route config sync between HA members –

# config system vdom-exception
    edit 1
        set object system.interface
    next
    edit 2
        set object router.static
    next
end

Note.
Config which are part of 'vdom-exception' should be manually configured on both the Fortigates.

Below is the available object to exclude.

log.fortianalyzer.setting                  
log.fortianalyzer.override-setting         
log.fortianalyzer2.setting                 
log.fortianalyzer2.override-setting        
log.fortianalyzer3.setting                 
log.fortianalyzer3.override-setting        
log.fortianalyzer-cloud.setting            
log.fortianalyzer-cloud.override-setting   
log.syslogd.setting                        
log.syslogd.override-setting               
log.syslogd2.setting                       
log.syslogd2.override-setting              
log.syslogd3.setting                       
log.syslogd3.override-setting              
log.syslogd4.setting                       
log.syslogd4.override-setting              
system.central-management                  
system.csf                                 
user.radius                                
system.interface                           
vpn.ipsec.phase1-interface                 
vpn.ipsec.phase2-interface                 
router.bgp                                 
router.route-map                           
router.prefix-list                         
firewall.ippool                            
firewall.ippool6                           
router.static                              
router.static6                             
firewall.vip                               
firewall.vip6                              
firewall.vip46                             
firewall.vip64                             
system.sdwan                               
system.saml                                
router.policy                              
router.policy6