Split Session sync / heartbeat

[Furil]

Hello,

I am currently using 2 "data" port for Hearbeat / session sync (different vlan, let's say vlan 10 for port1 and vlan 20 for port 2). I am planning add two new one to split the purpose. (port 3-4)

From what I understood the double HA heartbeat should not cause any issue even if both are in the same vlan because if we setup each interface wit different priority, only 1 will be used unless it goes down. (please do not hesitate to correct me if wrong).

What about the session sync ?

Currently :

Port 1 - vlan 10

Port 2 - vlan20

Port 3 and port 4 (session sync dedicated) must they be in the same vlan ? I was initially thinking of simply updating this way instead as there is no concept of priority for session sync... :

port 1 and 2 - vlan 10

port 3 and 4 - vlan 20

I know this is not not advised to use the "data" port instead of HA dedicated interface for Heartbeat interface, but the reason of not doing this is because there no longer any fiber port available on switch side for those interface ....

Thanks in advance for your help.

Furil

[lgupta]

Hello Furil, Good day!

Port 3 and port 4 (session sync dedicated) must they be in the same vlan ?

I don't think they should be in same vlan.

I referred this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-session-sync-dev-configuration/ta-p/196...

Here I read that: Selecting more than one interface, session synchronization traffic is load balanced among the selected interfaces.

This means there is no way to prioritize the interface like you can do with Heartbeat interfaces.
If you have two session-sync interfaces in same vlan, one interface would be receiving the traffic from other interface on same device because of broadcast nature of traffic inside the vlan (Session synchronization packets use Ethertype 0x8892) which may cause many more problems.

Please let us know if you have more doubt on this.

Thank you!