FGSP questions

[Badger_89]

Hi

About to deploy FGSP between 2 existing clusters, both clusters in a new environment with only test networks connected to them

I have 2 things I'm not clear on

1. I will be syncing a couple of VDOMS, is there any issue using the root VDOM for the sync link? Other options I have are create a new one for just this purpose, or finally use the test VDOM which has very little going on, and will be the least busy once the real network is connected.

2. In each cluster, the 2 firewalls are connected in usual fashion, 2 direct links. The FGSP link will be a lot higher bandwidth port. Do you normally leave it like that? Is session pickup on HA failover still running over the direct ports?

thanks

[AEK · Accepted solution]

Hi Badger

1. No issue at all when using root VDOM for sync link.
2. You mean by direct link p2p without L2 switch between them? Yes you can do that or use a switch needed. Yes session pickup are still running in both cases.

Just in my experience I used HA ports for FGSP because they are not connected to NPU. I'm not sure and I don't remember if using a NPU connected port is 100% safe for FGSP, you'll need to check.

[Badger_89]

Hi

thanks for the response....so yes to clarify...

In each FGCP cluster, FW1 and FW2 have 2 direct connection via HA and another copper port.

The ports that are currently planned for FGSP, are going to be higher speed due to the fibres required on the LAN network that will connect the clusters across the site to site link.

So I just wanted to confirm

1. is that normal/ok?

2. When a FGCP HA failover happens, the sessions just failover using the direct links as normal - which I think you confirmed is the case

thanks

[AEK]

1. For my last integration (DC FW) it was a so heavy load traffic so I used 2x 10G ports for FGSP sync and it worked fine. I couldn't take the risk using 1G ports with such high traffic. But I guess there may be some calculation to confirm if your FGSP sync ports are enough, but can't help further on that
2. Here you talk about FGCP HA right? So you have 2 pairs of FG, each pair is FGCP and sessions are synced between the two pars with FGSP, right. So yes when FGCP HA fail-over happens all the sessions (local and FGSP) will fail-over to the second HA node as if nothing happened

That said you need to fine tune your FGSP and test it well with all possible scenarios before go prod.

[Badger_89]

1. I'm actually thinking of doing the same as you for the sync links, I already have the fibre links in place that I can do 2 x 10G for FGSP into each FW. I couldn't see much info on FGSP bandwidth vs the main traffic links. But if I do 2X10 its more than enough for sure. I've seen people say they've used quite varied speeds for the sync link

2. yep correct, thanks

[AEK]

If you need more support on FGSP feel free to post your questions and we'll be happy to help.

[CatInHat]

Using the root VDOM for synchronization is not problematic, but may be a smart choice if that VDOM is the least loaded or has the largest resource available. However, creating a separate VDOM for synchronization may also be a smart solution to isolate this function from the main operations

[Badger_89]

great, thanks