Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
AEK
Honored Contributor

FGCP over FGSP sharing HA ports

Hello

We have 2 pairs of FortiGates, FGCP over FGSP

What can be the side effects of having HA1 & HA2 ports for synchronizing both FGSP and FGCP at the same time?

AEK
AEK
1 Solution
xshkurti
Staff
Staff

@AEK 


FGCP is a Layer 2 heartbeat that specifies how FortiGate units communicate in an HA cluster and keeps the cluster operating.


Whilst session synchronization between FGSP members uses an L3 connection over the peer IP by default. So HA1 and HA2 can have IP addresses configured and that will be used by FGSP members.

So technically there is no issue using HA1 and HA2 for both type of synch. The problem i see is in the design. If HA1 and HA2 for some reason go down, you will lose both synchronizations, and you will have strange failover situations (probably even split-brain) This is because HA1 and HA2 are recommended to be directly connected between 2 fortigates. But if you use HA1 and HA2 even for FGSP, i thing that you will have to use switch and router devices in between. 

Knowing this, the problem is all design, not technical.

 

View solution in original post

3 REPLIES 3
Anthony_E
Community Manager
Community Manager

Hello AEK,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello AEK,

 

We are still looking for someone to help you.

We will come back to you ASAP.


Regards,

Anthony-Fortinet Community Team.
xshkurti
Staff
Staff

@AEK 


FGCP is a Layer 2 heartbeat that specifies how FortiGate units communicate in an HA cluster and keeps the cluster operating.


Whilst session synchronization between FGSP members uses an L3 connection over the peer IP by default. So HA1 and HA2 can have IP addresses configured and that will be used by FGSP members.

So technically there is no issue using HA1 and HA2 for both type of synch. The problem i see is in the design. If HA1 and HA2 for some reason go down, you will lose both synchronizations, and you will have strange failover situations (probably even split-brain) This is because HA1 and HA2 are recommended to be directly connected between 2 fortigates. But if you use HA1 and HA2 even for FGSP, i thing that you will have to use switch and router devices in between. 

Knowing this, the problem is all design, not technical.

 

Top Kudoed Authors