Scribd Logo
Upload

Welcome to Scribd!

  • 5 views

    109-Active-Active Lab

    Uploaded by

    yosef.kredee

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    109-Active-Active Lab

    Uploaded by

    yosef.kredee
    5 views14 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    5 views14 pages

    109-Active-Active Lab

    Uploaded by

    yosef.kredee

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 14

    Active-Active Lab:

    FW1 (Primary) IP Schema


    Outside Layer 3 Interface Port1- 172.29.129.1/24
    Inside Layer 3 Interface Port2 - 192.168.1.254/24
    High availability (HA) 1 Port3 – Layer 2 no IP address
    High availability (HA) 2 Backup Port4 – Layer 2 no IP address
    FW2 (Secondary) IP Schema
    Outside Layer 3 Interface Port1- 172.29.129.1/24
    Inside Layer 3 Interface Port2 - 192.168.1.254/24
    HA1 or Control Link Port3 – Layer 2 no IP address
    HA1 or Control Link Backup Port4 – Layer 2 no IP address
    LAN PC Details
    LAN PC1 IP 192.168.1.1
    LAN PC2 IP 192.168.1.2
    LAN PC DNS 8.8.8.8, 1.1.1.1
    Firewall Management IP subnet 172.29.129.254
    Internet Gateway IP 192.168.122.254
    HA Details
    Mode Active-Active
    Device Priority Master 100
    Device Priority Slave 50
    Group Name HAG
    Heartbeat Ports Port3 and Port4

    1 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    Configure Primary Firewall:
    Login:
    First Console to Primary Firewall, configure hostname and Management interface.

    FortiGate-VM64-KVM # config system global


    FortiGate-VM64-KVM (global) # set hostname FW1
    FortiGate-VM64-KVM (global) # end
    FW1 # config system interface
    FW1 (interface) # edit port5
    FW1 (port5) # set ip 192.168.114.200/24
    FW1 (port5) # set allowaccess https http ssh ping
    FW1 (port5) # end

    Configure Interfaces:
    Go to Network>Interfaces select port1 Click Edit. In Alias type WAN, change the Address Mode
    to Manual type IP/Netmask 172.29.129.1/24, in Administrative access leave all the rest of
    configuration default and press OK button.

    2 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    Go to Network>Interfaces select port2 Click Edit in Alias type LAN, change the Address Mode to
    Manual type IP/Netmask 192.168.1.254/24, in Administrative access only checked PING leave
    all the rest of configuration default & press OK.

    Configure DNS:
    Go to Network > DNS , click on Specify and enter in primary / secondary DNS servers. In Primary
    DNS Server, type IP address of the primary DNS server 8.8.8.8. While in Secondary DNS Sever
    type 1.1.1.1 and Click Apply to save changes.

    3 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    Configure Default Route:
    To create a new default route, go to Network > Static Routes and create a static route for ISP.
    Set Destination to Subnet and leave the destination IP address set to 0.0.0.0/0.0.0.0. Set
    Gateway to the IP address provided by your ISP and Interface to the Internet-facing interface in
    my case 172.29.129.254 which the Gateway. Set the Interface to the WAN interface. Press OK
    to Save the changes.

    LAN to WAN Policy:


    Go to Policy & Objects > Firewall Policy. Give the policy a Name. Set the Incoming Interface to
    LAN and the Outgoing Interface to WAN. Set Source, Destination Address, Schedule, and
    Services, as required in this case All. Ensure the Action is set to ACCEPT. Turn on NAT and select
    Use Outgoing Interface Address.

    4 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    HA Active-Active Configuration:
    To start HA Configuration lets set HA interfaces names and Alias to recognize easily.

    By default, every FortiGate Device is in Standalone mode.

    5 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    Go to System > HA Select the Active-Active mode. Give Device Priority to MASTER Firewall a
    bigger number than the slave one (100). Set a group name and password for the cluster. You
    will use it again in slave machine. Enable Session Pickup: Enable this option to sync master to
    backup machine. Check the interface you want to monitor normally internet. Enable two
    heartbeats to create a stable HA.

    Verification of Primary:
    After HA configuration done, go to System > HA it will show below port1 is monitor port and
    Port3 and Port4 is heartbeat interfaces.

    6 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    Configure Slave Firewall:
    After configure are of Primary Firewall is done, we will be setting up slave machine. Console to
    Slave Firewall to configure Hostname and Management interface.
    FW2 hostname and Management
    FortiGate-VM64-KVM # config system global
    FortiGate-VM64-KVM (global) # set hostname FW2
    FortiGate-VM64-KVM (global) # end
    FW2 # config system interface
    FW2 (interface) # edit port5
    FW2 (port5) # set ip 192.168.114.210/24
    FW2 (port5) # set allowaccess https http ssh ping
    FW2 (port5) # end

    HA Active-Active Configuration:
    Before start HA Configuration let’s configure two HA ports Alias to recognize easily.

    7 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    Same as master, go to System > HA Select the Active-Active mode. Give Device Priority to SLAVE
    Firewall a lower number than the Master one (50). Set the same group name and same
    password for the cluster which already set on MASTER Firewall. Enable Session Pickup: Enable
    this option to sync master to backup machine. Check the interface you want to monitor
    normally internet. Enable two heartbeat to create a stable HA.

    Verification:
    Go to Primary Firewall go to System > HA you will find both firewall setting here.

    8 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    Go to Dashboard > Status, The HA Status dashboard widget also shows synchronization status.

    9 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    LAN PCs Configuration:

    10 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    Failover Verification:
    Let’s put continue ping from any LAN PC.

    Let’s powered off the primary Firewall you will be logging into the backup FortiGate.

    11 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    You will see a momentary pause in the ping results, until traffic diverts to the backup FortiGate,
    allowing the ping traffic to continue.

    Check the host name to verify the FortiGate that you have logged into. The FortiGate continues
    to operate in HA mode.

    12 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    if restart the primary FortiGate, after a few minutes it should rejoin the cluster and operate as
    the backup FortiGate. Traffic should not be disrupted when the restarted primary unit rejoins
    the cluster. The Override behavior allows firewall with higher numerical value to resume as
    Primary Firewall enable Override on Primary Firewall.
    FW1 # config system ha
    FW1 (ha) # set override enable
    FW1 (ha) # end

    13 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717


    14 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 00966564303717

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy