Table of Contents
Advertisement
High Availability
To connect to the GUI of the FPM module in chassis 1 slot 3 using HTTPS you would browse to
l
https://1.1.1.1:44313.
To send an SNMP query to the FPM module in chassis 2 slot 6 use the port number 16126.
l
Firmware upgrade
All of the modules in a FortiGate-7000 HA cluster run the same firmware image. You upgrade the firmware from
the GUI or CLI by logging into the primary FIM interface module using the system management IP address and
uploading the firmware image.
If uninterruptable-upgrade and session-pickup are enabled, firmware upgrades should only cause a
minimal traffic interruption. Use the following command to enable these settings (they should be enabled by
default). These settings are synchronized to all modules in the cluster.
config system ha
set uninterruptable-upgrade enable
set session-pickup enable
end
When enabled, the primary FIM interface module uploads firmware to all modules, but in this case, the modules
in the backup chassis install their new firmware and reboot and rejoin the cluster and resynchronize.
Then all traffic fails over to the backup chassis which becomes the new primary chassis. Then the modules in the
new backup chassis upgrade their firmware and rejoin the cluster. Unless override is enabled, the new primary
chassis continues to operate as the primary chassis.
Normally you would want to enable uninterruptable-upgrade to minimize traffic interruptions. But
unterruptable-upgrade does not have to be enabled. In fact, if a traffic interruption is not going to cause
any problems you an disable unterruptable-upgrade so that the firmware upgrade process takes less time.
Session failover (session-pickup)
Session failover means that after a failover, communications sessions resume on the new primary FortiGate-
7000 with minimal or no interruption. Two categories of sessions need to be resumed after a failover:
Sessions passing through the cluster
l
Sessions terminated by the cluster
l
Session failover (also called session-pickup) is not enabled by default for FortiGate-7000 HA. If sessions pickup is
enabled, while the FortiGate-7000 HA cluster is operating the primary FortiGate-7000 informs the backup
FortiGate-7000 of changes to the primary FortiGate-7000 connection and state tables for TCP and UDP sessions
passing through the cluster, keeping the backup FortiGate-7000 up-to-date with the traffic currently being
processed by the cluster.
FortiGate-7000
Fortinet Technologies Inc.
The formula for calculating the special port number is based on Chassis ID. CH1 =
Chassis ID1, CH2 = Chassis ID2. The formula is: service_port x 100 + (chassis_id – 1)
x 20 + slot_id.
Firmware upgrade
64
Advertisement
Table of Contents
