13-HA与会话同步.pptVIP

FAQ Q: 会话能否在两台FGT的不同的VDOM之间同步？ A: 不能，将在今后的版本中提供。 Q: 两台FGT对应的接口名是否应该相同？ A: 是的。 Q: 两台FGT对应的接口能否使用不同的Index？ A: 可以。 Q: 两台FGT对应的VLAN接口能否使用不同的VLAN ID？ A: 可以，只需要接口名称相同。 Q: 在 ‘config sys session-synch’命令下的edit X是否必须使用相同的数字？ A: 不用。 FAQ Q: FortiManager能否定义一个VDOM组，其中包含的VDOM属于不同的FortiGate？ (这样就可以直接给这一VDOM组推送策略) A: 可以 Q: 是否支持Zone或者聚合接口？ A: 是 Q: 是否仍然进行状态检测？ A: 是的，所有的TCP状态变化会在peer之间同步 Q: 是否支持非对称路由（出站流量和入站流量分别通过不同的设备）？ A: 不支持 以下接口未经测试: inter-vdom links, FA2接口, HA集群间的会话同步, 冗余接口 实验 两两一组，搭建环境，测试高可用性和集群 When operating in HA mode, multiple FortiGate firewalls operate as a Cluster, forming a single network entity. All other network devices (routers, switches, network users, etc) see the Cluster as a single entity, and have no knowledge of the HA mechanism, or that multiple firewalls exist. When in HA mode, all runtime data (configuration, session tables, etc) between the Primary and Secondary cluster members is synchronized. In the event that the Primary firewall fails, a Secondary firewall assumes control of the cluster, transparently to the end users and other network devices. Hardware and Firmware must be identical: Same Opmode Same HDD configuration Supported in NAT/Route and TP Opmode FGT60 and above support HA FGT800 and above are required for Full Mesh HA (redundant interfaces) Active-Active Allows for load balancing of AV scanned, or all TCP sessions (load-balance-all), sessions between cluster units. Provides redundancy and can increase performance for processing network traffic and security services. Active-Passive Allows for a hot spare The slave unit will not increase cluster performance Session Pick allows failover of non AV scanned sessions, no sync of AV scanned files between device proxies therefore AV scanned session do not failover Virtual Cluster Extension to A-P allowing Virtual Domains to be distributed between two Virtual Clusters providing redundancy and load balancing Configuration (sync-config) Synchronization of the config ensures that the slav