FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
ychia
Staff
Staff
Article Id 199251
Description This article discusses about '# diag sys session stat' between clusters which are not showing the same session_count.
Scope 6.4
Solution

To configure session synchronization between two clusters:

 

1) Configure the two clusters.

 

2) On cluster A, configure the peer IP for the interface:

# config system interface
    edit "port5"
        set vdom "root"
        set ip 10.10.10.1 255.255.255.0
        set allowaccess ping https ssh snmp http telnet
    next
end

In this example, cluster A uses port5 and its IP address, 10.10.10.1, is reachable from another cluster.

 

3) On cluster A, configure cluster and session synchronization:

# config system cluster-sync
    edit 1
        set peerip 10.10.10.2
    next
end

4) On cluster A, configure additional FGSP attributes as needed:

# config system standalone-cluster
    set standalone-group-id 1
    set group-member-id 0
    set session-sync-dev <interface>
end

The standalone-group-id must match between FGSP members. The group-member-id is unique for each FGCP cluster. session-sync-dev is an optional command to specify the interfaces to sync sessions.

 

5) On cluster B, configure the peer IP for the interface:

# config system interface
    edit "port5"
        set vdom "root"
        set ip 10.10.10.2 255.255.255.0
        set allowaccess ping https ssh snmp http telnet
    next
end

In this example, cluster B uses port5 and its IP address, 10.10.10.2, is reachable from another cluster.

 

6) On cluster B, configure cluster and session synchronization:

# config system cluster-sync
    edit 1
        set peerip 10.10.10.1
    next
end

7) On cluster B, configure additional FGSP attributes as needed:

# config system standalone-cluster
    set standalone-group-id 1
    set group-member-id 1
    set session-sync-dev <interface>
end
   
Contributors