Hot!Active Active HA

Author
vishal
Bronze Member
  • Total Posts : 23
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/05/30 09:03:07
  • Status: offline
2019/07/05 11:28:19 (permalink)
0

Active Active HA

Hi Everyone,

I'm having an doubt regarding an Active Active HA using FGT 200E. Can anyone help me regarding this.
1) Subordinate Active unit monitored interface need to configure IP address individually or it reflect from Primary Active unit when trigger happen.
2) I'm having 2 heartbeat interface for redundancy so assigning Heartbeat interface a priority affect primary or secondary unit selection during HA setup.

Any help will be highly appreciated.

Regards,
Vishal
#1

6 Replies Related Threads

    hubertzw
    Gold Member
    • Total Posts : 192
    • Scores: 5
    • Reward points: 0
    • Joined: 2018/04/16 13:29:04
    • Status: offline
    Re: Active Active HA 2019/07/06 08:13:47 (permalink)
    0
    Once you configure HA on both (if you have 2 device) they sync their config. Primary device will send it to secondary one. You can set different IP on both to allow access via ssh or https. Make sure you understand election process to set the right IP on the correct device. Priority is 3rd parameter to check (default settings) in the HA election process.
    #2
    ede_pfau
    Expert Member
    • Total Posts : 6050
    • Scores: 480
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Active Active HA 2019/07/07 02:49:35 (permalink)
    0
    @Vishal:
    1- all settings (except very few, like hostname) are duplicated between cluster members. So, port addresses as well. As you connect both ports (master and slave) to a L2 switch, this isn't a problem. They even have the same virtual MAC address (which in cheap switches may be a problem...).
    2- HBDEV priority isn't about master election. This parameter only distributes heartbeat traffic across multiple HA links (which is a best practice). You influence election by setting "override" and port monitoring. Port monitoring triggers a failover when a monitored port fails. And of course, the monitored port setting is duplicated between cluster members.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #3
    hubertzw
    Gold Member
    • Total Posts : 192
    • Scores: 5
    • Reward points: 0
    • Joined: 2018/04/16 13:29:04
    • Status: offline
    Re: Active Active HA 2019/07/07 05:20:51 (permalink)
    0
    One more comment: if you have different vlans for port1 and port2, make sure all ports of all cluster members are placed in the corect VLAN. That's critical in active active concept. Primary unit must be able to forward traffic from its port1 to port1 of the secondary unit.
    #4
    vishal
    Bronze Member
    • Total Posts : 23
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/05/30 09:03:07
    • Status: offline
    Re: Active Active HA 2019/07/07 06:13:06 (permalink)
    0
    Hi Ede_pfau,

    Thanks for your reply.

    As per your above points in which you have describe all settings has been duplicated between cluster members including port address. It is applicable in Active Active HA also ?

    Means if I connect my two fortigate internal interfaces with 2 switches in stack and forms a A-A HA.

    So assigning ip address to 1st Active Fortigate internal interface that same would be replicated on 2nd Active Fortigate internal interface and traffic load sharing/balance would be achieved.

    Correct if I'm wrong. Thanks in advance
    #5
    ede_pfau
    Expert Member
    • Total Posts : 6050
    • Scores: 480
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Active Active HA 2019/07/09 02:36:17 (permalink)
    0
    Synchronization of the config is identical for A-P and A-A clusters.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #6
    emnoc
    Expert Member
    • Total Posts : 5252
    • Scores: 347
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: online
    Re: Active Active HA 2019/07/09 02:52:38 (permalink)
    0
    You mention stacked switches are you doing a LACP bundle between each FGT200E to each switch member ? Regardless, the A-A or A-P in a stacked env will not matter. I would also ensure ( I believe that you are ) that each HBDEv interfaces are cabled back-2-back and introduce into the switch stack.
     
    So if your looking for the max in HA and with bandwidth you could take fgt-port1+2 and create a bonded interface and cables these to switch members sw1+sw2 and  fgt-ports 3+4 as port-member cabled to switch members sw1+sw2
     
    Finally for layer3 interfaces you could easily do 802.1q tagging.
     
    Ken Felix

    PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
    #7
    Jump to:
    © 2019 APG vNext Commercial Version 5.5