Fortigate HA

참고 Session Sync https://community.fortinet.com/t5/FortiGate/Technical-Note-Sessions-synchronization/ta-p/195515?externalID=FD35014 https://community.fortinet.com/t5/FortiGate/Technical-Note-HA-session-sync-dev-configuration/ta-p/196776 Config https://tae-yeong.tistory.com/254 Cookbook https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/669702/high-availability-with-fgcp-expert

High Availability

구성도

Fortigate Active 설정

Hostname 설정

config system global
    set hostname "Fortigate_A"

HA 설정

config system ha
    config system ha
    set group-id 1     set group-name "HA" #HA 그룹간 이름 설정 Standby 장비와 동일해야 함     
    set mode a-p #HA Active-Standby 모드     
    set password P@Ssw0rd #HA 그룹간 패스워드 설정 Standby 장비와 동일해야 함     
    set hbdev "port3" 100 # Heartbeat를 송수신할 인터페이스 지정, Config 및 Session 정보 송수신 용도     
    set session-pickup enable # TCP 세션, 30초 이상의 세션만 동기화     
    set session-pickup-connectionless enable #ICMP 및 UDP 세션 동기화     
    set override enable #Active가 B장비로 넘어간 후 A장비가 다시UP되었을 때 A장비로 Active를 넘기는 기능     
    set priority 250

상기 명령 적용시키면 Fortigate는 가상 MAC으로 ARP를 날린다 Client에서 Fortigate의 ARP 정보를 삭제하면 더 빠르게 확인할 수 있다.

Fortigate Standby 설정

Hostname 설정

config system global
    set hostname "Fortigate_B"

HA 설정

config system ha
    config system ha
    set group-id 1     
    set group-name "HA"     
    set mode a-p
    set password P@Ssw0rd
    set hbdev "port3" 100     
    set priority 100

상기 명령 적용 후 HB인터페이스인 Port3을 통해 HA를 맺는다.

HA 구성 확인

Fortigate_A # diagnose sys ha status
HA information
Statistics
traffic.local = s:0 p:6182 b:1223627
traffic.total = s:0 p:6216 b:1225919
activity.fdb  = c:0 q:0
Model=80001, Mode=2 Group=1 Debug=0 nvcluster=1, ses_pickup=1, delay=0  [Debug_Zone HA information]
HA group member information: is_manage_master=1.
FGVMEVH33DDKJFB0: Master, serialno_prio=1, usr_priority=250, hostname=Fortigate_A
FGVMEVSOXVVQFT89:  Slave, serialno_prio=0, usr_priority=100, hostname=Fortigate_B
[Kernel HA information]
vcluster 1, state=work, master_ip=169.254.0.2, master_id=0:
FGVMEVH33DDKJFB0: Master, ha_prio/o_ha_prio=0/0
FGVMEVSOXVVQFT89:  Slave, ha_prio/o_ha_prio=1/1

Fortigate_B # diagnose sys ha status 
HA information
Statistics
traffic.local = s:0 p:0 b:0
traffic.total = s:0 p:0 b:0
activity.fdb  = c:0 q:0
Model=80001, Mode=2 Group=1 Debug=0 nvcluster=1, ses_pickup=1, delay=0  [Debug_Zone HA information]
HA group member information: is_manage_master=0.
FGVMEVSOXVVQFT89:  Slave, serialno_prio=0, usr_priority=100, hostname=Fortigate_B
FGVMEVH33DDKJFB0: Master, serialno_prio=1, usr_priority=250, hostname=Fortigate_A
[Kernel HA information]
vcluster 1, state=standby, master_ip=169.254.0.2, master_id=0:
FGVMEVSOXVVQFT89:  Slave, ha_prio/o_ha_prio=1/1
FGVMEVH33DDKJFB0: Master, ha_prio/o_ha_prio=0/0

HA Active 선출과정

Number of Monitored Interfaces : 연결된 모니터 인터페이스의 수 HA UPtime : System UPtime이 더 높은 장비 Device Priority : 장비에 설정되어 있는 priority 값 Serial Number : 장비 일련번호

Failover 테스트

Monitor 인터페이스 Down - EVE-NG 환경에서 테스트 어려움

Active Shutdown

Fortigate_A # execute shutdown 
This operation will shutdown the system !
Do you want to continue? (y/n)y

Fortigate_B # diagnose sys ha status 
HA information
Statistics
traffic.local = s:0 p:407 b:68712
traffic.total = s:0 p:407 b:68712
activity.fdb  = c:0 q:0
Model=80001, Mode=2 Group=1 Debug=0 nvcluster=1, ses_pickup=1, delay=0  [Debug_Zone HA information]
HA group member information: is_manage_master=1.
FGVMEVSOXVVQFT89: Master, serialno_prio=0, usr_priority=100, hostname=Fortigate_B
[Kernel HA information]
vcluster 1, state=work, master_ip=169.254.0.1, master_id=0:
FGVMEVSOXVVQFT89: Master, ha_prio/o_ha_prio=0/0

Fortigate_B장비가 Actvie되며, GARP 발송

ICMP 한개 빠지고 통신됨