fgt2-高可靠性在主設(shè)備上做配置會(huì)同

FortiGate高可靠?CopyrightFortinetInc.All 什么是FortiGateFortiGate設(shè)備組成2Active-Passive

量3Active-Active4HA必要條24相同的FortiGate設(shè)1條(最好是兩條或以上)鏈路來進(jìn)行心跳和同PortPortHBPortHBPort5主

Begin?diagnosesyshareset-

6主Override

Begin?ChangetheHA

7發(fā) o包到集群中所有的在active-passive中在active-active中會(huì)話不同步只有在active-active8 端?如果主設(shè)備失效,多個(gè)從設(shè)備會(huì)從 一個(gè)新的主設(shè)9虛擬MAC地址和切址 址FormerNew

HTTP

VirtualMAC:09-01-01PhysicalMAC:0b-a1---

3a-

3b–

PhysicalMAC:0b-a4-

PhysicalMAC:0b-a4-dstMAC09-01-01,srcMACX,TCPSYNdportdstMAC0b-a4-8c,srcMAC0b-a1-c0,TCPSYNdport3b.dstMACX,srcMAC0b-a4-8c,TCPSYNACKsport80(fromHTTPHTTPVirtualMAC:09-01-PhysicalMAC:0b-a1-

--

PhysicalMAC:0b-a4-dstMAC09-01-01,srcMACX,TCPACKdportHTTP

VirtualVirtualMAC:09-01-PhysicalMAC:0b-a1-6-7-8-PhysicalMAC:0b-a4-dstMAC0b-a4-8e,srcMAC0b-a1-c2,TCPSYNACKsport觸發(fā)切換的條件Eventlogs,SNMPtraps,和 ?如果主FortiGate失效,另一臺(tái)會(huì)自動(dòng)接管其?集群可 接口來判斷他們是否在運(yùn)行或連接狀態(tài)是否正?如果主設(shè)備的一個(gè)接口down掉，則集群重 一個(gè)主設(shè)FortiGateFortiGateClusteringProtocol?發(fā)現(xiàn)其他屬于同一HA組的FortiGate ?同步配置和其他?當(dāng)FortiGate設(shè)備發(fā)生故障時(shí)及時(shí)TCPport?：序列號最高的?：序列號第二高的?：序列號第三高的。。?IP地址只會(huì)在有成員離 集群時(shí)才發(fā)生變HA配置同完整同2主設(shè)備會(huì)檢查從設(shè)備備

NewHA配置同

增量同

HA配置同?包括動(dòng)態(tài)數(shù)據(jù)如DHCP分配，路由表更新，在active-passiveHA中,量同步也包括會(huì)HA 連續(xù)5次不匹配，從設(shè)備會(huì)從主設(shè) 配HA的保留管理接?可以在每一個(gè)FortiGate上配置不同的接口?HA管理接口的配置變化不會(huì)被同步的其他成員HAHA虛擬集群和設(shè)備優(yōu)先級Host可同步的會(huì)話表主要針對TCP和 ?只有不是被UTMproxy處理的會(huì)話會(huì)被同configsystemsetsession-pickupUDPICMPconfigsystemsetsession-pickupsetsession-pickup-connectionless A

BABAC?在Active-Passive模式下?從不同VDOM接收的流量可以流向不同的主設(shè)如果集群在Active-Active模式下,會(huì)關(guān)閉負(fù)載均集群會(huì)將所有從設(shè)備進(jìn)行 新主之前的主設(shè)備進(jìn)行如果集群在Active-Active模式下，流量負(fù)載均衡恢FullMeshFullMesh?有些FortiGate型號支FortiGateSessionLifeSupportProtocol active-passiveHA的一種替代?UDP和ICMP會(huì)話，NAT會(huì)話和配置也可以同?只適用于沒有被UTMproxy處理的流量FortiGateSessionLifeSupportProtocol在每臺(tái)FortiGate上配置:configsysteminterfaceedit"port2"setvdomsetipconfigsystemsession-syncedit1setpeeripsetpeervd"root"setsyncvd

對端FortiGateIPPort2接口的VDOM名configsyssession-pickup-configsyssetsession-pickupGUI上查看HA狀#diagnosesyshastatusHAinformationtraffic.local=s:0p:22713b:traffic.total=s:0p:22713b:463298activity.fdb=c:0q:0Model=5,Mode=2Group=113nvcluster=1,ses_pickup=0,

CLI查看HA狀HAgroupmemberinformation:is_manage_master=.FGVM010000015546,1.master:200FGVM010000015546FGVM010000015550,0.CLI查看HA狀vcluster1,state=work,FGVM010000015546,0.master:200FGVM010000015550,1.slave:128CLI上連接從設(shè) #executehamanage#executehamanage

pleaseinputpeerboxSubsidaryunit#diagnosesyshashowcsumglobal:fe8db4430e6de4cc1265efd27aa9root:2af053010ebea6734675127937b159all:f844a