Hello
We have 2 pairs of FortiGates, FGCP over FGSP
What can be the side effects of having HA1 & HA2 ports for synchronizing both FGSP and FGCP at the same time?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
FGCP is a Layer 2 heartbeat that specifies how FortiGate units communicate in an HA cluster and keeps the cluster operating.
Whilst session synchronization between FGSP members uses an L3 connection over the peer IP by default. So HA1 and HA2 can have IP addresses configured and that will be used by FGSP members.
So technically there is no issue using HA1 and HA2 for both type of synch. The problem i see is in the design. If HA1 and HA2 for some reason go down, you will lose both synchronizations, and you will have strange failover situations (probably even split-brain) This is because HA1 and HA2 are recommended to be directly connected between 2 fortigates. But if you use HA1 and HA2 even for FGSP, i thing that you will have to use switch and router devices in between.
Knowing this, the problem is all design, not technical.
Hello AEK,
Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
Thanks,
Hello AEK,
We are still looking for someone to help you.
We will come back to you ASAP.
Regards,
FGCP is a Layer 2 heartbeat that specifies how FortiGate units communicate in an HA cluster and keeps the cluster operating.
Whilst session synchronization between FGSP members uses an L3 connection over the peer IP by default. So HA1 and HA2 can have IP addresses configured and that will be used by FGSP members.
So technically there is no issue using HA1 and HA2 for both type of synch. The problem i see is in the design. If HA1 and HA2 for some reason go down, you will lose both synchronizations, and you will have strange failover situations (probably even split-brain) This is because HA1 and HA2 are recommended to be directly connected between 2 fortigates. But if you use HA1 and HA2 even for FGSP, i thing that you will have to use switch and router devices in between.
Knowing this, the problem is all design, not technical.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1690 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.