Technical Tip: How to configure multiple links for FGSP peer redundancy

maydin · ‎09-29-2022

Description

This article describes how the FGSP is used to sync sessions between FGCP clusters or two standalone FortiGate.

Multiple FGSP sync links can be configured to have physical link redundancy.

Prior FortiGate 6.4.10, multiple links for FGSP peers could be added as separate entries under 'config system cluster-sync', however HA system treated them as multiple peers, thus sync messages are sent over each link.

Scope

FortiGate 6.4.10, 7.0.6, 7.2.0 and above.

Solution

To prevent this, group-member-id is introduced to identify the members, each member has a unique id to identify itself in the cluster, each member has the knowledge to other peers across multiple links (peer IPs),so duplicated HA sync messages will not be sent/received from/to the same peer.

FG1800F-1 (global) # config system standalone-cluster
FG1800F-1 (standalone-cluster) # show
config system standalone-cluster
set standalone-group-id 222
set group-member-id 1
end

FG1800F-1 (standalone-cluster) set standalone-group-id
standalone-group-id Enter an integer value from <0> to <255>.
FG1800F-1 (standalone-cluster) set group-member-id
group-member-id Enter an integer value from <0> to <15>.

In the above config, standalone-group-id should be the same in all FGSP peers. Group-member-id should be unique for each FGSP member.

Note that configuring this in an existing FGSP cluster will impact FGSP Traffic.

FG1800F-1 (global) # config system standalone-cluster
FG1800F-1 (standalone-cluster) # set group-member-id 2
FG1800F-1 (standalone-cluster) # show
config system standalone-cluster
set standalone-group-id 222
set group-member-id 2
end

FG1800F-1 (standalone-cluster) # end
Changing standalone-group-id or group-member-id will potentially affect FGSP traffic.
Please first make sure the member is isolated from FGSP cluster properly.
Do you want to continue? (y/n)y