FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
ydong01
Staff
Staff
Article Id 341818
Description This article describes that when configuring monitor-interface/pingsvr-monitor-interface, if the interface name length is over 7 characters, the new feature "FGSP support for failover with asymmetric traffic and UTM" will not work.
Scope FortiGate v 7.6.0
Solution

There is a new feature in v7.6.0: FGSP support for failover with asymmetric traffic and UTM.

 

  1. When the Interface name has more than 7 characters, fgsp_route_health shows 0. The feature will not work:

 

config system standalone-cluster
....
    set monitor-interface "lag_trust" "lag_untrust"     << Over 7 characters
end

 

diagnose test application sessionsync 1
HA is not enabled
sync context:
sync-enabled=0, sync-tcp=1, sync-nat=1
sync-other=1, sync-exp=1, standalone-sync=1, mtu=0
ipsec-tun-sync=1
fgsp-peers-num=1, kernel-filters-num=1
fgsp-peers:
vdom=0, ip/port=10.1.100.2:708
fgsp_route_health=0
mondev: Bundle_(0)

 

  1. When the Interface name is less than 7 characters, fgsp_route_health shows 1, the feature will not work:

 

config system standalone-cluster
....
    set monitor-interface "lag_t" "lag_u"          << Less 7 characters   
end

 

diagnose test application sessionsync 1
HA is not enabled
sync context:
sync-enabled=0, sync-tcp=1, sync-nat=0
sync-other=1, sync-exp=1, standalone-sync=1, mtu=0
ipsec-tun-sync=1
fgsp-peers-num=1, kernel-filters-num=6
fgsp-peers:
vdom=0, ip/port=10.1.100.2:708
fgsp_route_health=1

 

The workaround is to reduce the interface name length to less than 7 characters.