Fortinet FortiGate-7060E Handbook
  1. Manuals
  2. Brands
  3. Fortinet Manuals
  4. Firewall
  5. FortiGate-7060E
  6. Handbook

Fortinet FortiGate-7060E Handbook

Fortios
Hide thumbs Also See for FortiGate-7060E:
Table of Contents

Advertisement

Quick Links

Download this manual See also: System Manual
7000
FortiOS™ Handbook - FortiGate-7000
VERSION 5.4.5

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the FortiGate-7060E and is the answer not in the manual?

Questions and answers

Related Manuals for Fortinet FortiGate-7060E

Summary of Contents for Fortinet FortiGate-7060E

  • Page 1 7000 FortiOS™ Handbook - FortiGate-7000 VERSION 5.4.5...
  • Page 2 FORTINET DOCUMENT LIBRARY http://docs.fortinet.com FORTINET VIDEO GUIDE http://video.fortinet.com FORTINET BLOG https://blog.fortinet.com CUSTOMER SERVICE & SUPPORT https://support.fortinet.com  http://cookbook.fortinet.com/how-to-work-with-fortinet-support/ FORTIGATE COOKBOOK http://cookbook.fortinet.com FORTINET TRAINING SERVICES http://www.fortinet.com/training FORTIGUARD CENTER http://www.fortiguard.com FORTICAST http://forticast.fortinet.com END USER LICENSE AGREEMENT http://www.fortinet.com/doc/legal/EULA.pdf FORTINET PRIVACY POLICY https://www.fortinet.com/corporate/about-us/privacy.html FEEDBACK Email: techdocs@fortinet.com December 20, 2017 FortiOS™ Handbook - FortiGate-7000 01-545-3966550-20171220...
  • Page 3 HA Link failure threshold changes (422264 ) FortiGate-7000s running FortiOS v5.4.5 can be configured as dialup IPsec VPN servers 9 FortiGate-7000 overview Licenses, Device Registration, and Support FortiGate-7060E FortiGate-7060E front panel FortiGate-7060E schematic FortiGate-7040E FortiGate-7040E front panel FortiGate-7040E schematic FortiGate-7030E...
  • Page 4 Accelerated IPS, SSL VPN, and IPsec VPN (CP9 content processors) Getting started with FortiGate-7000 Managing individual modules Managing individual modules from the CLI Connecting to module CLIs using the management module Connecting to the FortiOS CLI of the FIM module in slot 1 Default VDOM configuration Default management VDOM Firmware upgrades...
  • Page 5 Managing individual modules in HA mode Firmware upgrade Session failover (session-pickup) Enabling session pickup for TCP and UDP If session pickup is disabled Primary unit selection and failover criteria Verifying primary chassis selection How link and module failures affect primary chassis selection FIM module failures Management link failures Link failure threshold and board failover tolerance...
  • Page 6 SSL VPN Authentication Traffic shaping and DDoS policies Sniffer mode (one-arm sniffer) FortiGuard Web Filtering Log messages include a slot field FortiOS Carrier Special notice for new deployment connectivity testing FortiGate-7000 Load balancing commands config load-balance flow-rule Syntax status {disable | enable} src-interface <interface-name>...

  • Page 7: Change Log

    LACP aggregate. November 2, 2017 Updated with new information throughout the document including a new HA chapter. August 30, 2017 Updated with new information throughout the document. December 1, 2016 Initial Release FortiGate-7000 Fortinet Technologies Inc.

  • Page 8: Introduction

    FSSO user authentication is synchronized FSSO user authentication is synchronized to all FIM and FPM modules. FSSO users are no longer required to re- authenticate when sessions are processed by a different FIM or FPM module. FortiGate-7000 Fortinet Technologies Inc.

  • Page 9: Ha Link Failure Threshold Changes (422264 )

    IPsec VPN server. If more than one local subnet is added to the phase 2, only the first one is advertised to the server. Dialup client configuration: config vpn ipsec phase1-interface FortiGate-7000 Fortinet Technologies Inc.
  • Page 10 1.2.0.1 set psksecret <password> config vpn ipsec phase2-interface edit "to-fgt7k" set phase1name "to-fgt7k" set src-subnet 4.2.6.0 255.255.255.0 set dst-subnet 4.2.0.0 255.255.0.0 next edit "to-fgt7k-2" set phase1name "to-fgt7k" set src-subnet 4.2.7.0 255.255.255.0 set dst-subnet 4.2.0.0 255.255.0.0 FortiGate-7000 Fortinet Technologies Inc.

  • Page 11: Fortigate-7000 Overview

    Use the chassis serial number when requesting support from Fortinet for the product. All Fortinet licensing, including FortiCare Support, IPS, AntiVirus, Web Filtering, Mobile Malware, FortiClient, FortiCloud, and additional virtual domains (VDOM) is for the entire FortiGate-7000 product and not for individual components.

  • Page 12: Fortigate-7060E

    FortiGate-7060E front panel FortiGate-7060E The FortiGate-7060E is a 8U 19-inch rackmount 6-slot chassis with a 80Gbps fabric and 1Gbps base backplane designed by Fortinet. The fabric backplane provides network data communication and the base backplane provides management and synch communication among the chassis slots.

  • Page 13: Fortigate-7060E Schematic

    Power is provided to the chassis using four hot swappable 3+1 redundant 100-240 VAC, 50-60 Hz power supply units (PSUs). You can also optionally add up to six PSUs to provide 3+3 redundancy. The FortiGate-7060E can also be equipped with DC PSUs allowing you to connect the chassis to -48V DC power The standard configuration of the FortiGate-7060E includes two FIM (interface) modules in chassis slots 1 and 2 and up to four FPM (processing) modules in chassis slots 3 to 6.

  • Page 14: Fortigate-7040E

    The FortiGate-7040E is a 6U 19-inch rackmount 4-slot chassis with a 80Gbps fabric and 1Gbps base backplane designed by Fortinet. The fabric backplane provides network data communication and the base backplane provides management and synch communication among the chassis slots.

  • Page 15: Fortigate-7040E Schematic

    The FortiGate-7030E is a 6U 19-inch rackmount 3-slot chassis with a 80Gbps fabric and 1Gbps base backplane designed by Fortinet. The fabric backplane provides network data communication and the base backplane provides management and synch communication among the chassis slots.

  • Page 16: Fortigate-7030E Front Panel

    FortiGate-7030E front panel (example module configuration) (missing or bad snippet) FortiGate-7030E schematic The FortiGate-7030E chassis schematic below shows the communication channels between chassis components including the management module (MGMT), the FIM module (called FIM1) and the FPM modules (FPM3 and FPM4). FortiGate-7000 Fortinet Technologies Inc.
  • Page 17 FPM3 and FPM4 (IPMB addresses 0x86 and 0x88) are the FPM processor modules in slots 3 and 4. These worker modules process sessions distributed to them by the FIM module. FPM modules include NP6 processors to offload sessions from the FPM CPU and CP9 processors that accelerate content processing. FortiGate-7000 Fortinet Technologies Inc.

  • Page 18: Fim-7901E Interface Module

    One 1Gbps base backplane channel for base backplane with each FPM module installed in the same chassis as the FIM-7901E. One 40Gbps fabric backplane channel for fabric backplane communication with the other FIM-7901E in the chassis. FortiGate-7000 Fortinet Technologies Inc.

  • Page 19: Fim-7901E Schematic

    One 1Gbps base backplane channel for base backplane communication with the other FIM-7901E in the chassis. On-board DP2 processors and an integrated switch fabric to provide high-capacity session-aware load balancing. One front panel USB port. Power button. NMI switch (for troubleshooting as recommended by Fortinet Support). Mounting hardware. LED status indicators. FIM-7901E schematic The FIM-7901E includes an integrated switch fabric (ISF) that connects the front panel interfaces to the DP2 session-aware load balancers and to the chassis backplanes.

  • Page 20: Fim-7904E Interface Module

    If M1 and M2 are connected to the same switch, Q-in-Q must be enabled on the switch. Four 10/100/10000BASE-T out of band management Ethernet interfaces (MGMT1 to MGMT4). One 80Gbps fabric backplane channel for traffic distribution with each FPM module installed in the same chassis as the FIM-7904E. FortiGate-7000 Fortinet Technologies Inc.

  • Page 21: Splitting The Fim-7904E B1 To B8 Interfaces

    You can split the interfaces of the FIM-7904Es in slot 1 and slot 2 at the same time by entering a single CLI command. Splitting the interfaces requires a system reboot so Fortinet recommends that you split multiple interfaces at the same time according to your requirements to avoid traffic disruption.

  • Page 22: Fim-7910E Interface Module

    The FIM-7910E can be installed in any FortiGate-7000 series chassis in hub/switch slots 1 and 2. The FIM-7910E provides four C form-factor pluggable 2 (CFP2) interfaces for a FortiGate-7000 chassis. Using a 100GBASE- SR10 multimode CFP2 transceiver, each CFP2 interface can also be split into ten 10GBASE-SR interfaces. FIM-7910E front panel FortiGate-7000 Fortinet Technologies Inc.

  • Page 23: Splitting The Fim-7910E C1 To C4 Interfaces

    You can split the interfaces of the FIM-7910Es in slot 1 and slot 2 at the same time by entering a single CLI command. Splitting the interfaces requires a system reboot so Fortinet recommends that you split multiple interfaces at the same time according to your requirements to avoid traffic disruption.

  • Page 24: Fim-7910E Hardware Schematic

    Using a 100GBASE-SR4 QSFP28 or 40GBASE-SR4 QSFP+ transceiver, each QSFP28 interface can also be split into four 10GBASE-SR interfaces. You can also install FIM-7920Es in a second chassis and operate the chassis in HA mode with another set of processor modules to provide chassis failover protection. FortiGate-7000 Fortinet Technologies Inc.

  • Page 25: Changing The Interface Type And Splitting The Fim-7920E C1 To C4 Interfaces

    On-board DP2 processors and an integrated switch fabric to provide high-capacity session-aware load balancing. One front panel USB port. Power button. NMI switch (for troubleshooting as recommended by Fortinet Support). Mounting hardware. LED status indicators. Changing the interface type and splitting the FIM-7920E C1 to C4 interfaces By default, the FIM-7920E C1 to C4 interfaces are configured as 100GE QSFP28 interfaces.

  • Page 26: Splitting The C1 To C4 Interfaces

    You can split the interfaces of the FIM-7920Es in slot 1 and slot 2 at the same time by entering a single CLI command. Splitting the interfaces requires a system reboot so Fortinet recommends that you split multiple interfaces at the same time according to your requirements to avoid traffic disruption.

  • Page 27: Fpm-7620E Processing Module

    Two 1Gbps base backplane channels for management, heartbeat and session sync communication. Dual CPUs for high performance operation. Four NP6 processors to offload network processing from the CPUs. Eight CP9 processors to offload content processing and SSL and IPsec encryption from the CPUs. FortiGate-7000 Fortinet Technologies Inc.

  • Page 28: Np6 Network Processors - Offloading Load Balancing And Network Traffic

    FIM-7904E interface module FPM-7620E processing module FPM-7620E front panel Power button. NMI switch (for troubleshooting as recommended by Fortinet Support). Mounting hardware. LED status indicators. NP6 network processors - offloading load balancing and network traffic The four FPM-7620E NP6 network processors combined with the FIM module integrated switch fabric (ISF) provide hardware acceleration by offloading load balancing from the FPM-7620E CPUs.
  • Page 29 FPM-7620E processing module FIM-7904E interface module FPM-7620E hardware architecture FortiGate-7000 Fortinet Technologies Inc.

  • Page 30: Accelerated Ips, Ssl Vpn, And Ipsec Vpn (Cp9 Content Processors)

    Sub public key engine (PKCE) to support up to 4096 bit operation directly (4k for DH and 8k for RSA with CRT) DLP fingerprint support TTTD (Two-Thresholds-Two-Divisors) content chunking Two thresholds and two divisors are configurable FortiGate-7000 Fortinet Technologies Inc.

  • Page 31: Getting Started With Fortigate-7000

    You can also configure aggregate interfaces that include physical interfaces from both interface modules. The following example Unit Operation dashboard widget shows a FortiGate-7040E with FIM-7901E modules in slots 1 and 2 and FPM modules in slots 3 and 4. FortiGate-7000 Fortinet Technologies Inc.

  • Page 32: Managing Individual Modules

    The special port number (in this case 44301) is a combination of the service port (for HTTPS the service port is 443) and the chassis slot number (in this example, 01). The following table lists the special ports to use to connect to each chassis slot using common admin protocols: FortiGate-7000 Fortinet Technologies Inc.

  • Page 33: Managing Individual Modules From The Cli

    Connecting to module CLIs using the management module All FortiGate-7000 chassis includes a front panel management module (also called a shelf manager) on the chassis front panel. See the system guide for your chassis for details about the management module. FortiGate-7000 Fortinet Technologies Inc.

  • Page 34: Connecting To The Fortios Cli Of The Fim Module In Slot 1

    1. Connect the console cable supplied with your chassis to Console 1 and to your PC or other device RS-232 console port. 2. Start a terminal emulation program on the management computer. Use these settings: Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1, and Flow Control None. FortiGate-7000 Fortinet Technologies Inc.

  • Page 35: Default Vdom Configuration

    Restarting the FortiGate-7000 To restart all of the modules in a FortiGate-7000 chassis, connect to the primary FIM module CLI and enter the command execute reboot. When you enter this command all of the modules in the chassis reboot. FortiGate-7000 Fortinet Technologies Inc.

  • Page 36: Load Balancing

    For example, the following configuration sends all IKE traffic to the primary FPM: config load-balance flow-rule edit 1 set status enable set vlan 0 set ether-type ip set protocol udp set src-l4port 500-500 set dst-l4port 500-500 set action forward FortiGate-7000 Fortinet Technologies Inc.

  • Page 37: Recommended Configuration For Traffic That Cannot Be Load Balanced

    2123-2123 next edit 21 set status enable set ether-type ip set protocol tcp set dst-l4port 10443-10443 set comment "ssl vpn to the primary FPM" next edit 22 FortiGate-7000 Fortinet Technologies Inc.
  • Page 38 4500-4500 set comment "ipv6 ike-natt dst" next edit 29 set status enable set ether-type ipv6 set protocol esp set comment "ipv6 esp" next edit 30 set ether-type ipv4 FortiGate-7000 Fortinet Technologies Inc.

  • Page 39: Configuration Synchronization

    1. Power down the failed module by pressing the front panel power button. 2. Remove the module from the chassis. 3. Insert the replacement module. It should power up when inserted into the chassis if the chassis has power. FortiGate-7000 Fortinet Technologies Inc.

  • Page 40: Replacing A Failed Module In A Fortigate-7000 Chassis In An Ha Cluster

    If in_sync is not equal to 1 or if a module is missing in the command output you can try restarting the modules in the chassis by entering execute reboot from any module CLI. If this does not solve the problem, contact Fortinet support. Replacing a failed module in a FortiGate-7000 chassis in an HA cluster 1.

  • Page 41: Installing Firmware On An Fim Or Fpm Module From The Bios Using A Tftp Server

    If in_sync is not equal to 1 or if a module is missing in the command output you can try restarting the modules in the chassis by entering execute reboot from any module CLI. If this does not solve the problem, contact Fortinet support. Installing firmware on an FIM or FPM module from the BIOS using a TFTP...
  • Page 42 If in_sync is not equal to 1 or if a module is missing in the command output you can try restarting the modules in the chassis by entering execute reboot from any module CLI. If this does not solve the problem, contact Fortinet support. FortiGate-7000...

  • Page 43: Uploading Firmware From A Tftp Server To An Fpm Module

    [S]: Set local Subnet Mask: Set as required for your network. [G]: Set local gateway: Set as required for your network. [V]: Local VLAN ID: The VLAN ID of the FIM interface that can connect to the TFTP server: FIM01 local VLAN IDs FortiGate-7000 Fortinet Technologies Inc.
  • Page 44 If in_sync is not equal to 1 or if a module is missing in the command output you can try restarting the modules in the chassis by entering execute reboot from any module CLI. If this does not solve the problem, contact Fortinet support. FortiGate-7000...

  • Page 45: Operating A Fortigate-7000

    The following command output shows the sync status of the FIM modules in a FortiGate-7000 chassis. The field in_sync=1 indicates that the configurations of the modules are synchronized. diagnose sys confsync status | grep in_sy FIM04E3E16000080, Slave, uptime=177426.45, priority=2, slot_id=1:2, idx=0, flag=0x0, in_sync=1 FIM10E3E16000063, Master, uptime=177415.38, priority=1, slot_id=1:1, idx=1, flag=0x0, in_sync=1 FortiGate-7000 Fortinet Technologies Inc.

  • Page 46: Replacing A Failed Module In A Fortigate-7000 Chassis In An Ha Cluster

    If in_sync is not equal to 1 or if a module is missing in the command output you can try restarting the modules in the chassis by entering execute reboot from any module CLI. If this does not solve the problem, contact Fortinet support. Replacing a failed module in a FortiGate-7000 chassis in an HA cluster 1.

  • Page 47: Uploading Firmware From A Tftp Server To An Fim Module

    10. Press C to set up the TFTP configuration. 11. Use the BIOS menu to set the following. Only change settings if required. [P]: Set image download port: MGMT1 (change if required) [D]: Set DHCP mode: Disabled FortiGate-7000 Fortinet Technologies Inc.

  • Page 48: Uploading Firmware From A Tftp Server To An Fpm Module

    If in_sync is not equal to 1 or if a module is missing in the command output you can try restarting the modules in the chassis by entering execute reboot from any module CLI. If this does not solve the problem, contact Fortinet support. Uploading firmware from a TFTP server to an FPM module Use the following steps to upload firmware from a TFTP server to an FPM module.
  • Page 49 If you need to make any corrections, press C and make the changes as required. When the configuration is correct proceed to the next step. 14. Press T to start the TFTP transfer. The firmware image is uploaded from the TFTP server and installed on the FPM module which then reboots. FortiGate-7000 Fortinet Technologies Inc.
  • Page 50 If in_sync is not equal to 1 or if a module is missing in the command output you can try restarting the modules in the chassis by entering execute reboot from any module CLI. If this does not solve the problem, contact Fortinet support. FortiGate-7000...

  • Page 51: Ipsec Vpn

    2 configuration. Enter the following command to add the source and destination subnets to the FortiGate-7000 IPsec VPN Phase 2 configuration. config vpn ipsec phase2-interface edit "to_fgt2"So set phase1name "to_fgt2" set src-subnet 172.16.1.0 255.255.255.0 FortiGate-7000 Fortinet Technologies Inc.

  • Page 52: Example Multiple Subnet Ipsec Vpn Phase 2 Configuration

    And then put the five firewall addresses into two firewall address groups. config firewall addrgrp edit "local_group" set member "local_subnet_1" "local_subnet_2" next edit "remote_group" set member "remote_subnet_3" "remote_subnet_4" "remote_subnet_5" Now, use the firewall address groups in the Phase 2 configuration: FortiGate-7000 Fortinet Technologies Inc.

  • Page 53: Configuring The Fortigate-7000 As A Dialup Ipsec Vpn Server

    < password> Configure the phase 2, to support dialup IPsec VPN, set the destination subnet to 0.0.0.0 0.0.0.0. config vpn ipsec phase2-interface edit dialup-server set phase1name dialup-server set src-subnet 4.2.0.0 255.255.0.0 set dst-subnet 0.0.0.0 0.0.0.0 FortiGate-7000 Fortinet Technologies Inc.

  • Page 54: Troubleshooting

    Master FPM Blade: slot-4 Slot 3: FPM20E3E17900113 Status:Working Function:Active Link: Base: Up Fabric: Up Heartbeat: Management: Good Data: Good Status Message:"Running" Slot 4: FPM20E3E16800033 Status:Working Function:Active Link: Base: Up Fabric: Up Heartbeat: Management: Good Data: Good Status Message:"Running" FortiGate-7000 Fortinet Technologies Inc.
  • Page 55 41120083d27eb1d3c5c5e464d0a36f27b78a0f5a dec:pkts/bytes=286338/40910978, enc:pkts/bytes=562327/62082855 npu_flag=03 npu_rgwy=4.2.0.2 npu_lgwy=4.2.0.1 npu_selid=b dec_npuid=3 enc_ npuid=1 Log into the CLI of any of the FIM modules and run the command diagnose test application fctrlproxyd 2. The output should show matching destination subnets. FortiGate-7000 Fortinet Technologies Inc.
  • Page 56 (5) checksum:27 AE 00 EA 10 8D 22 0C D6 48 AB 2E 7E 83 9D 24 vd:3 p1:to-fgt2 p2:to-fgt2 subnet:4.2.3.0 mask:255.255.255.0 enable:1 vd:3 p1:to-fgt2 p2:to-fgt2 subnet:4.2.4.0 mask:255.255.255.0 enable:1 vd:3 p1:to-fgt2 p2:to-fgt2 subnet:4.2.5.0 mask:255.255.255.0 enable:1 ========================================= FortiGate-7000 Fortinet Technologies Inc.

  • Page 57: High Availability

    Before you begin configuring HA Before you begin, the chassis should be running the same FortiOS firmware version and interfaces should not be configured to get their addresses from DHCP or PPPoE. Register and apply licenses to the each FortiGate-7000 FortiGate-7000 Fortinet Technologies Inc.

  • Page 58: Connect The M1 And M2 Interfaces For Ha Heartbeat Communication

    All of the M1 interfaces must be connected together with a switch and all of the M2 interfaces must be connected together with another switch. Connecting M1 interfaces or M2 interfaces directly is not supported as each FIM needs to communicate with all other FIMs. FortiGate-7000 Fortinet Technologies Inc.
  • Page 59 If you are using one switch for both M1 and M2 connections, the configuration would be the same except you would add q-in-q support and two different VLANs, one for M1 traffic and one for M2 traffic. FortiGate-7000 Fortinet Technologies Inc.

  • Page 60: Ha Configuration

    This adds basic HA settings to this FIM interface module. 2. Repeat this configuration on the FIM interface module in slot 2 (FIM02). config system ha set mode a-p set password <password> set group-id <id> set chassis-id 1 set hbdev M1/M2 FortiGate-7000 Fortinet Technologies Inc.
  • Page 61 Module SN: FIM04E3E16000085 Chassis HA mode: a-p Chassis HA information: [Debug_Zone HA information] HA group member information: is_manage_master=1. FG74E83E16000015: Slave, serialno_prio=1, usr_priority=128, hostname=CH15 FG74E83E16000016: Master, serialno_prio=0, usr_priority=127, hostname=CH16 HA member information: CH16(FIM04E3E16000085), Master(priority=0), uptime=78379.78, slot=1, chassis=2(2) FortiGate-7000 Fortinet Technologies Inc.

  • Page 62: Ha Management Configuration

    You can create one aggregate interface on the switch and connect both chassis management interfaces to it. LACP is not supported for the mgmt interface aggregate interface. The mgmt interfaces are in a static aggregate interface. FortiGate-7000 Fortinet Technologies Inc.

  • Page 63: Managing Individual Modules In Ha Mode

    Ch2 slot 1 FIM01 8003 44321 2321 2221 16121 Ch2 slot 2 FIM02 8002 44322 2322 2222 16122 Ch2 slot 4 FPM04 8004 44324 2324 2224 16124 Ch2 slot 6 FPM06 8006 44326 2326 2226 16126 For example: FortiGate-7000 Fortinet Technologies Inc.

  • Page 64: Firmware Upgrade

    FortiGate-7000 HA cluster is operating the primary FortiGate-7000 informs the backup FortiGate-7000 of changes to the primary FortiGate-7000 connection and state tables for TCP and UDP sessions passing through the cluster, keeping the backup FortiGate-7000 up-to-date with the traffic currently being processed by the cluster. FortiGate-7000 Fortinet Technologies Inc.

  • Page 65: Enabling Session Pickup For Tcp And Udp

    HA heartbeat network bandwidth usage. Also if your FortiGate-7000 HA cluster is mainly being used for traffic that is not synchronized (for example, for proxy-based security profile processing) enabling session pickup is not recommended since most sessions will not be failed over anyway. FortiGate-7000 Fortinet Technologies Inc.

  • Page 66: Primary Unit Selection And Failover Criteria

    Negotiation and primary chassis selection also takes place if the one of the criteria for selecting the primary chassis changes. For example, an interface can become disconnected or module can fail. After this happens, the cluster can renegotiate to select a new primary chassis also using the criteria shown below. FortiGate-7000 Fortinet Technologies Inc.
  • Page 67 Primary unit selection and failover criteria High Availability FortiGate-7000 Fortinet Technologies Inc.

  • Page 68: Verifying Primary Chassis Selection

    For another example, the following diagnose sys ha status command shows the HA status for a cluster where one chassis has a disconnected or failed data interface and the other chassis has a failed FPM module. diagnose sys ha status ========================================================================== Slot: 2 Module SN: FIM01E3E16000088 Chassis HA mode: a-p Chassis HA information: FortiGate-7000 Fortinet Technologies Inc.
  • Page 69 One of the interfaces on the FIM module in slot 1 of chassis 2 must have failed. In a normal HA configuration the FIM modules in matching slots of each chassis should have redundant interface connections. So if one module has fewer connected interfaces this indicates a link failure. FortiGate-7000 Fortinet Technologies Inc.

  • Page 70: Fim Module Failures

    1, at least two interfaces will have to fail. Board failover tolerance You can use the following command to configure board failover tolerance. config system ha set board-failover-tolerance <tolerance> The tolerance range is 0 to 12, and 0 is the default. FortiGate-7000 Fortinet Technologies Inc.

  • Page 71: Priority And Primary Chassis Selection

    When override is enabled primary unit selection checks the traffic bandwidth score, aggregate interface state, management interface links and FPM module failures first. So any of these factors affect primary chassis selection, even if override is enabled. FortiGate-7000 Fortinet Technologies Inc.

  • Page 72: Fortigate-7000 V5.4.5 Special Features And Limitations

    FPM using a flow rule. IP Multicast IPv4 and IPv6 Multicast traffic is only sent to the primary FPM module (usually the FPM in slot 3). This is controlled by the following configuration: config load-balance flow-rule edit 18 FortiGate-7000 Fortinet Technologies Inc.

  • Page 73: High Availability

    FortiGate Session Life Support Procotol (FGSP) HA (also called standalone session synchronization) is not supported. Shelf Manager Module It is not possible to access SMM CLI using Telnet or SSH. Only console access is supported using the chassis front panel console ports as described in the FortiGate-7000 system guide. FortiGate-7000 Fortinet Technologies Inc.

  • Page 74: Fortios Features That Are Not Supported By Fortigate-7000 V5.4.5

    IPsec VPN dialup or dynamic tunnels require a flow rule that sends traffic destined for IPsec dialup IP pools to the primary FPM module. In an HA configuration, IPsec SAs are not synchronized to the backup chassis. IPsec SAs are re-negociated after a failover. FortiGate-7000 Fortinet Technologies Inc.

  • Page 75: Traffic Shaping And Ddos Policies

    Special notice for new deployment connectivity testing Only the primary FPM module can successfully ping external IP addresses. During a new deployment, while performing connectivity testing from the Fortigate-7000, make sure to run execute ping tests from the primary FPM module CLI. FortiGate-7000 Fortinet Technologies Inc.
  • Page 76 FortiGate-7000 v5.4.5 special features and limitations Special notice for new deployment connectivity testing FortiGate-7000 Fortinet Technologies Inc.

  • Page 77: Fortigate-7000 V5.4.3 Special Features And Limitations

    FPM using a flow rule. Link monitoring and health checking ICMP-based link monitoring for SD-WAN, ECMP, HA link monitoring, and firewall session load balancing monitoring (or health checking) is not supported. Using TCP or UDP options for link monitoring instead. FortiGate-7000 Fortinet Technologies Inc.

  • Page 78: Ip Multicast

    The range for the HA group-id is 0 to 14. Failover logic for FortiGate-7000 v5.4.3 HA is not the same as FGSP for other FortiGate clusters. HA heartbeat configuration is specific to FortiGate-7000 systems and differs from standard HA. FortiGate-7000 Fortinet Technologies Inc.

  • Page 79: Shelf Manager Module

    Dynamic routing and policy routing is not supported for IPsec interfaces. Remote network subnets are limited to /16 prefix. IPsec static routes don't consider distance, weight, priority settings. IPsec static routes are always installed in the routing table, regardless of the tunnel state. FortiGate-7000 Fortinet Technologies Inc.

  • Page 80: More About Ipsec Vpn Routing Limitations

    FSSO is supported. Each FPM independently queries the server for user credentials. RSSO is only supported after creating a load balance flow rule to broadcast RADIUS accounting messages to all FPM modules. FortiGate-7000 Fortinet Technologies Inc.

  • Page 81: Traffic Shaping And Ddos Policies

    Special notice for new deployment connectivity testing Only the primary FPM module can successfully ping external IP addresses. During a new deployment, while performing connectivity testing from the Fortigate-7000, make sure to run execute ping tests from the primary FPM module CLI. FortiGate-7000 Fortinet Technologies Inc.

  • Page 82: Fortigate-7000 Load Balancing Commands

    <ip-address> <netmask> set dst-addr-ipv6 <ip-address> <netmask> set protocol {any | icmp | tcp | udp | igmp | sctp | gre | esp } ah | ospf | pim | vrrp} set src-l4port <start>[-<end>] set dst-l4port <start>[-<end>] FortiGate-7000 Fortinet Technologies Inc.

  • Page 83: Status {Disable | Enable}

    Use append to add multiple options. The default action is forward. The mirror-ingress option copies (mirrors) all ingress packets that match this flow rule and sends them to the interface specified with the mirror-interface option. FortiGate-7000 Fortinet Technologies Inc.

  • Page 84: Set Mirror-Interface

    {round-robin | src-ip | dst-ip | src-dst-ip | src-ip- sport | dst-ip-dport | src-dst-ip-sport-dport} config workers edit 3 set status enable set weight 5 gtp-load-balance {disable | enable} Enable GTP load balancing for FortiGate-7000 configurations licensed for FortiOS Carrier. FortiGate-7000 Fortinet Technologies Inc.

  • Page 85: Max-Miss-Heartbeats

    Set the weight and enable or disable each worker. Use the edit command to specify the slot the worker is installed in. You can enable or disable each worker and set each worker's weight. FortiGate-7000 Fortinet Technologies Inc.
  • Page 86 The weight range is 1 to 10. 5 is average, 1 is -80% of average and 10 is +100% of average. The weights take effect if weighted-loadbalance is enabled. config workers edit 3 set status enable set weight 5 FortiGate-7000 Fortinet Technologies Inc.
  • Page 87 Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any forward-looking statements herein are not accurate.

This manual is also suitable for:

Fortigate-7000Fortigate-7904eFortigate-7901eFortigate-7040eFortigate-7030eFortigate-7910e ... Show all

Table of Contents