High Availability
New high availability features include:
- DHCP and PPPOE Support for Active-Passive Mode
- VRRP Support
- Trigger Failover
- Synchronizing a GTP Tunnel over Physical Ports
- IPv6 Management Interface Gateway
DHCP and PPPOE Support for Active-Passive Mode
High Availability is now supported in Active-Passive mode when there are interfaces working in DHCP client or PPPOE client mode.
VRRP Support
Additional features have been added to support Virtual Router Redundancy Protocol (VRRP).
VRRP Groups
A VRRP group includes all the relevant VRRP IDs and tracks the VRRP status in order to force the status of all group members if a VRRP domain is changed from master to backup.
VRRP groups are configured through the CLI. The VRRP group ID can be between 1 and 65535.
Syntax
config system interface
edit <port>
config vrrp
edit <id>
set vrgrp <id>
end
end
A VRRP column has also been added to the interfaces list in the web-based manager that will show the VRRP ID, group, and status. This list can be found at System > Network > Interfaces.
Using a Second Destination IP (VRDST)
VRRP can now be configured with second destination IP (VRDST) for monitoring. When two IPs are used, VRRP failure will only be reported if both monitored IPs are down. A second VRDST can be configured using the CLI.
Syntax
config system interface
edit <interface>
config vrrp
edit <id>
set vrdst <ip1> <ip2>
end
end
Trigger Failover
HA failover can now be enabled and disabled using the following CLI commands:
diagnose sys ha set-as-master enable
: immediately enables the local FortiGate unit as the HA master.diagnose sys ha set-as-master disable
: immediately disables this mode. Optionally, a time frame can be added afterdisable
, which will disable the mode at the appointed time. The time format is yyyy-mm-dd hh:mm:ss.
Synchronizing a GTP Tunnel over Physical Ports
In order to properly handle GPRS Tunneling Protocol (GTP) synchronization under high stress loads, FortiOS 5.2 will use the interfaces set in set session-sync-dev
(part of config system ha
) to allow GTP tunnels to synchronize directly over physical ports when both the HA primary and secondary are up. A new diagnose command, diagnose firewall gtp hash-stat
, has also been added to display GTP hash stat separately.
IPv6 Management Interface Gateway
IPv6 management interface gateways are now supported in FortiOS 5.2.
Syntax
config system ha
set ha-mgmt-interface-gateway6 <IPv6_address>
end