ACL synchronization between two Fortigate clusters

[xwiz]

Hello!

I need to synchronization ACL between two Fortigate clusters. They are installed on the edge of my network. Does fortigate have such features?

I could do this by combining two clusters into one consisting of 4 Fortigate. But I have different models Fortigate: 2 Fortigate 600 D and 2 Fortigate 501 E. Can I combine them? How to do this?

[DirkDuesentrieb]

Hi,

best way imho is to do it with FortiManager. This way you can

[ul]

have one policy that you assign to multiple devices/clusters.

handle exceptions where you apply individual rules to only one cluster

create site specific objects with the same name but different IPs on the clusters[/ul]

If you know CheckPoint you'll see similarities.

We created a desaster recovery design with this. The DR site has a smaller FortiGate and different management and public networks, but the VM IPs are the same.

Hope that helps,

Dirk

[emnoc]

options

[ul]

API

automation tools ( ansible, expect, naplam)

or put the policy in a script and upload the script[/ul]

We do a combination of all of these from above and use "zone-interface for name" in the policy to get around difference in port names between different hardware if we change anything out.

e.g

instead of port1 port2 or lan we use zones 

INTERNET

DMZ

INTERNAL

We manage like 8 different DR sites, that's  scattered thru the world by using this approach and we are lazy so each rule has all other  subnets in a address-group for simplification outside of the SNAT and VIP  the internal are 100% identical.

So DMZ_LAN for SITE1  has  a address-group named DMZ but has the primary and DR subnets in that group. We copy the same group to Primary and DR site firewall. We also have the same policy-#s inused between the site ( we manually set policy # for this ) 

So site1 primary policy#1192 is the same as DR #1192, make for diff and config sync to be much easier in the long run. So if you need to add a custom-service XYZ to a policy we select the policy# and added the services.

We do the same with our AWS instance also, fwiw

Ken Felix

[poundy]

I have a similar need, where I have a disjointed but similar FW in another site that has the same broad config details as the primary site. I had used scripts to sync things, and compare config exports using Notepad++ compare feature (after stripping things like UUIDs that are unique). But of late I have been using PowerShell and PowerFGT module to create policies and objects on both firewalls at the same time. 

[xwiz]

thanks for you answers. I'll think about it

[xwiz]

up