Syncing configuration to DR site

[Haggai]

HelloOn primary site we have an HA cluster.On DR site a different hardware (same FortiOS version) exists, connected to the network without external interfaces on normal status.How can we auto sync the config to the DR? Thank you

[emnoc]

Not possible , what you can do is set  a scripts to copy out the  objects and copy the object out to the 2nd  DR cluster. This is easy todo if you standardize the  networks

e.g

MAIN-cluster

1.1.1.1   MAINHOST01

1.1.1.2   MAINHOST02

1.1.1.3   MAINHOST03

2.1.1.1   DRHOST01

2.1.1.2   DRHOST02

2.1.1.3   DRHOST03

Now what we do  is take a unix script to sed and replace  MAIN to DR and the network space and then copy the objects out to the DR.

Now when we activate the DR  they plumb the 2.1.1.1 2.1.1.2 and 2.1.1.3 devices in VMware and as a symmetrical configuration that matches the main-site

[Alexis_G]

If you have minor differences in hardware you can form HA according to below refernece:

http://kb.fortinet.com/kb/viewContent.do?externalId=FD35376&sliceId=1

otherwise you need to move the subordinary member to DR site,

I generally for these decisions you need more info. Like:

The DR is it cold site or hot site ?

Do you have L2 connectivity between PRI and DR site ?

Do you have bandwidth ?

[Haggai]

jklapas wrote:

If you have minor differences in hardware you can form HA according to below refernece:

http://kb.fortinet.com/kb/viewContent.do?externalId=FD35376&sliceId=1

otherwise you need to move the subordinary member to DR site,

I generally for these decisions you need more info. Like:

The DR is it cold site or hot site ?

Do you have L2 connectivity between PRI and DR site ?

Do you have bandwidth ?

Due to different hardware it is not part of the cluster.

Cold DR site.

Connectivity between sites L2 based.

No bandwidth limitations.

[sw2090]

I meant more interface-names then port names. Those are hardcoded and on some FGT it is portx and on some it is internalx even with the same FortiOS Version. 

Also there are Options that withen the same FortOS Version do not exist on one FGT Model but do exist on others.

Plus there may be differences in supported features...

[sw2090]

what you could do is enable admin-scp on cli and then get the config of the cluster via scp. HOwever even if the other FGT run the same FortiOS Version they may have different port layout or names etc so in most of the cases the config will not run without editing it.