HA Session Pickup for BGP TCP 179

[johnlloyd_13]

hi,

i'm doing a failover test on FG 401F in HA with iBGP peer to two upstream router.

i noticed iBGP peers bounced when failover to secondary. i already had 'session pickup' enabled in HA setting.

the link below mentioned most TCP but none specific for BGP.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-session-failover-session-pickup/ta-p/19...

is there other setting needed to enable/configure so that BGP peering will remain up and don't tear down whenever there's an HA failover?

[vsahu]

Hello Johnlloyd,

1) If the override is disabled on Fortigate Running in HA A-P mode, after the active FGT reboots and comes up, it will remain as current secondary, and traffic will be handled by the new active FGT.
2) A secondary FGT will take 1.2 seconds to understand that the primary FGT has failed. FortiGates assume the other FortiGate has failed if they don't receive a heartbeat packet from a cluster unit for six times 200 = 1200 milliseconds (1.2 seconds).
3) There is no synchronization of UDP and ICMP sessions by default. UDP and ICMP sessions will be down, so you can enable failover of UDP and ICMP sessions, kindly use the following command.
#config system ha
#set session-pickup-connectionless enable
#end
http://docs.fortinet.com/document/fortigate/6.0.0/handbook/595772/tcp-udp-icmp-and-multicast-session...
4) Since BGP daemon works only on master unit, the BGP peering sessions (port 179) will need to be re-established on slave unit after failover, while ICMP sessions will remain active on both new master and old slave until the peering is re-established on the new master.
5) fter failover all BGP routes (get router info routing-table bgp) will be removed on the old master and will be re-established once BGP peering is re-stablished again on the new master unit.
6) IPsec sessions with port 500 exist only on Master, after failover this session will be seen on both the new master and old slave unit until the BGP peering session (port 179) is established on new master unit, once the BGP
session is re-established on new master unit, the IPsec session with port 500 will be disappeared on old slave unit.
7) In order to minimize the route learning time, you can configure the following:
BGP: set the keep alive xx + holdtime timer xx
HA : config: set route-ttl 200
Enabling the "graceful restart" in the Spoke and HUB
8) For better detection of fallover, we can configure Llink monitors in HA.
9) In all collaboration, we can achieve a very quick failover, and the only time it takes for the slave to become a master is when the traffic is being affected.

REF: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Controlling-how-HA-synchronizes-routing-ta...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-HA-and-BGP-graceful-...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-HA-link-failed-signal-and-switch...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPSec-VPN-in-HA-Environment/ta-p/195849
https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-session-failover-session-pickup/ta-p/19...

[johnlloyd_13]

hi,

understood for BGP need to re-establish during failover.

seem FG doesn't retain S2S ipsec VPN not unlike the cisco ASA which is retained during failover.

[Toshi_Esumi]

I think most of static ones won't drop. We have hundreds of them on clusters and a swap over sometimes happens without anybody noticing.

Toshi