Solved: How do I configure multiple links for FGSP peer redundancy?

This article describes how the FGSP is used to sync sessions between FGCP clusters or two standalone FortiGate.

Multiple FGSP sync links can be configured to have physical link redundancy.

Prior FortiGate 6.4.10, multiple links for FGSP peers could be added as separate entries under ‘config system cluster-sync’, however HA system treated them as multiple peers, thus sync messages are sent over each link.

Scope

FortiGate 6.4.10, 7.0.6, 7.2.0 and above.

Solution

To prevent this, group-member-id is introduced to identify the members, each member has a unique id to identify itself in the cluster, each member has the knowledge to other peers across multiple links (peer IPs),so duplicated HA sync messages will not be sent/received from/to the same peer.

FG1800F-1 (global) # config system standalone-cluster
FG1800F-1 (standalone-cluster) # show
# config system standalone-cluster
set standalone-group-id 222
set group-member-id 1
end

FG1800F-1 (standalone-cluster) set standalone-group-id
standalone-group-id Enter an integer value from <0> to <255>.
FG1800F-1 (standalone-cluster) set group-member-id
group-member-id Enter an integer value from <0> to <15>.

In above config, standalone-group-id should be same in all FGSP peers. Group-member-id should be unique for each FGSP member.

Note that, configuring this in an existing FGSP cluster will impact FGSP Traffic.