Hot!ACL synchronization between two Fortigate clusters

Author
xwiz
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/05/14 04:34:40
  • Status: offline
2020/05/14 04:45:38 (permalink)
0

ACL synchronization between two Fortigate clusters

Hello!
I need to synchronization ACL between two Fortigate clusters. They are installed on the edge of my network. Does fortigate have such features?
 
I could do this by combining two clusters into one consisting of 4 Fortigate. But I have different models Fortigate: 2 Fortigate 600 D and 2 Fortigate 501 E. Can I combine them? How to do this?
 
post edited by xwiz - 2020/05/17 07:45:40
#1

4 Replies Related Threads

    DirkDuesentrieb
    New Member
    • Total Posts : 18
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/09/14 01:30:14
    • Status: offline
    Re: ACL synchronization between two Fortigate clusters 2020/05/15 03:29:23 (permalink)
    0
    Hi,
    best way imho is to do it with FortiManager. This way you can
    • have one policy that you assign to multiple devices/clusters.
    • handle exceptions where you apply individual rules to only one cluster
    • create site specific objects with the same name but different IPs on the clusters
    If you know CheckPoint you'll see similarities.
     
    We created a desaster recovery design with this. The DR site has a smaller FortiGate and different management and public networks, but the VM IPs are the same.
     
    Hope that helps,
     
    Dirk
    #2
    emnoc
    Expert Member
    • Total Posts : 5622
    • Scores: 357
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: ACL synchronization between two Fortigate clusters 2020/05/15 09:27:36 (permalink)
    0
    options
     
    • API
    • automation tools ( ansible, expect, naplam)
    • or put the policy in a script and upload the script
    We do a combination of all of these from above and use "zone-interface for name" in the policy to get around difference in port names between different hardware if we change anything out.
     
    e.g
     
    instead of port1 port2 or lan we use zones 
     
    INTERNET
    DMZ
    INTERNAL
     
    We manage like 8 different DR sites, that's  scattered thru the world by using this approach and we are lazy so each rule has all other  subnets in a address-group for simplification outside of the SNAT and VIP  the internal are 100% identical.
     
    So DMZ_LAN for SITE1  has  a address-group named DMZ but has the primary and DR subnets in that group. We copy the same group to Primary and DR site firewall. We also have the same policy-#s inused between the site ( we manually set policy # for this ) 
     
    So site1 primary policy#1192 is the same as DR #1192, make for diff and config sync to be much easier in the long run. So if you need to add a custom-service XYZ to a policy we select the policy# and added the services.
     
    We do the same with our AWS instance also, fwiw
     
    Ken Felix
     
     
     

    PCNSE 
    NSE 
    StrongSwan  
    #3
    poundy
    Bronze Member
    • Total Posts : 25
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/06/13 20:58:45
    • Status: offline
    Re: ACL synchronization between two Fortigate clusters 2020/05/15 19:29:18 (permalink)
    0
    I have a similar need, where I have a disjointed but similar FW in another site that has the same broad config details as the primary site. I had used scripts to sync things, and compare config exports using Notepad++ compare feature (after stripping things like UUIDs that are unique). But of late I have been using PowerShell and PowerFGT module to create policies and objects on both firewalls at the same time. 
    #4
    xwiz
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/05/14 04:34:40
    • Status: offline
    Re: ACL synchronization between two Fortigate clusters 2020/05/21 01:58:32 (permalink)
    0
    thanks for you answers. I'll think about it
    #5
    Jump to:
    © 2020 APG vNext Commercial Version 5.5