Description
This article provides an explanation of how to configure FSSO for failover.
Solution
In this scenario 2 DCs will be used: 2008 and 2012. On both DCs are installed FSSO in version 5.0.0237. Only one FSSO collector agent is connected to FortiGate unit at the moment.
The FortiGate configuration is shown below:
The 2012 server shows as connected to the FortiGate and IP address of 2012 server is in bold font. The FSSO service will now be stopped on the 2012 server (or simulate that DC 2012 is not reachable).
The FortiGate then switches to the next FSSO collector agent specified in configuration.
In CLI the configuration is as follows:
config user fsso
edit "fsso"
set server "10.94.0.173"
set server2 "10.94.0.174"
next
end
FGVM010000018394 # diag debug authd fsso server-status
Server Name Connection Status Version
----------- ----------------- -------
fsso connected FSSO 5.0.0237
The FortiGate configuration is shown below:
The FortiGate then switches to the next FSSO collector agent specified in configuration.
config user fsso
edit "fsso"
set server "10.94.0.173"
set server2 "10.94.0.174"
next
end
FGVM010000018394 # diag debug authd fsso server-status
Server Name Connection Status Version
----------- ----------------- -------
fsso connected FSSO 5.0.0237
