Installing 1 policy from FM to FGT Clusters with different interfaces names

[canoas]

Hi there!

Is it possible to install the same single policy to say 5 FGT Clusters from Forti Mrg, but each of the 5 Clusters has different interface names? The same single policy will be pushed to each Cluster as a Global FW policy not a VDOM.............or is the only way via a VDOM with normalized interfaces from the FM? later mapping INTERNAL interface to Port1 on Cluster-1 and INTERNAL3 on Cluster-2 etc.........

[PoEHub · Accepted solution]

Yes, you can install the same policy to multiple FortiGate (FGT) clusters, even if they have different interface names. However, managing it as a Global FW policy without using VDOMs can get tricky. As you mentioned, one way to handle this is by normalizing interfaces using VDOMs and then mapping the appropriate interfaces (e.g., INTERNAL to Port1, INTERNAL3, etc.). For more detailed troubleshooting and tips on FortiGate cluster configurations, PoEHub (https://poehub.org/) offers some great resources. Hope that helps!

[PoEHub · Accepted solution]

Yes, you can install the same policy to multiple FortiGate (FGT) clusters, even if they have different interface names. However, managing it as a Global FW policy without using VDOMs can get tricky. As you mentioned, one way to handle this is by normalizing interfaces using VDOMs and then mapping the appropriate interfaces (e.g., INTERNAL to Port1, INTERNAL3, etc.). For more detailed troubleshooting and tips on FortiGate cluster configurations, PoEHub (https://poehub.org/) offers some great resources. Hope that helps!

[dingjerry_FTNT · Accepted solution]

Hi @canoas ,

Another way is:

1) Create a Zone object on the FGT Clusters including those interfaces as members.  It's OK even if there is only one interface.

2) Importing the FGT clusters.  If the FGT clusters are in FMG already, you may re-import them again.  This step will import the Zone object and dynamic mapping different interface members based on those FGT clusters.

[canoas]

I think this maybe the most straight forward solution, though I have found re-iimporting clusters into FM again problematic in the past, perhaps with v7.x I won't have these issues. Thanks.