myITmicroblog

I participated in a discussion about a High Availability feature on Cisco ASA and FortiGate. We were talking about active-active, active-passive and active-standby modes. What was funny, we talked about the same features using different names. Yes, Cisco and Fortinet, they use different names for the same features. Let me explain it to avoid similar misunderstanding. 1) Cisco ASA  They are two modes available: a) active/standby - the method is available only in standalone mode. The concept is simple: you have two devices: a primary and a secondary. When it possible the primary is an active device and the secondary a standby. Only one device (active) processes traffic and the standby waits passively, monitoring the status of the active one. When failure happens (failure of the device, an interface, etc.), it triggers a fail-over and the secondary (standby)  becomes the active one (secondary/active). b) active/active - this mode is only available in multi-contex...

High availability is mandatory in most of today's network designs. Only very small companies or branches can run their business without redundancy. When you have Fortigate firewall in your network you have many options to increase network availability. You can use Fortigate Clustering Protocol ( FGCP ) or Virtual Router Redundancy Protocol ( VRRP ). FGCP has two modes: 'override' disabled (default) and 'override' enabled . I'm not going to explain how to set up HA as you can find many resources on Fortinet websites: https://cookbook.fortinet.com/high-availability-two-fortigates-56/ https://cookbook.fortinet.com/high-availability-with-fgcp-56/ Let's recap what is the main difference between them. The default HA setting is 'override' disabled and this is an order of selection an active unit: 1) number of monitored interfaces - when both units have the same number of working (up) interfaces check next parameter 2) HA uptime - an ...

Today I’m going to present how to implement a high availability for ZBPF. Below you can see the scenario I work on: As you see I have two routers (R1 and R2) which now operates separately. From R4 we can reach R5 via R1 and R2:   R4 #sh ip route Codes : L - local , C - connected , S - static , R - RIP , M - mobile , B - BGP D - EIGRP , EX - EIGRP external , O - OSPF , IA - OSPF inter area N1 - OSPF NSSA external type 1 , N2 - OSPF NSSA external type 2 E1 - OSPF external type 1 , E2 - OSPF external type 2 i - IS - IS , su - IS - IS summary , L1 - IS - IS level - 1 , L2 - IS - IS level - 2 ia - IS - IS inter area , * - candidate default , U - per - user static route o - ODR , P - periodic downloaded static route , H - NHRP , l - LISP + - replicated route , % - next hop override Gateway of last resort is not set 4.0 . 0.0 / 8 is variably subnetted , 2 subn...

Today I would like to talk about high availability. The second KS is one example how we can increase its availability. Let’s think about GMs. If there are more paths than one to a KS we should consider using a loopback interface for communication with the KS.      We can add following command on the GM: crypto map MAP - NAME local - address INT - NAME We have to ensure that: the loopback interface is reachable from KS’ FW access list accepts traffic from and to this IP ISAKMP SA from a KS before change: R2 #sh crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn - id status 6.6 . 6.2 4.4 . 4.2 GDOI_IDLE 1002 ACTIVE 3.3 . 3.2 6.6 . 6.2 GDOI_IDLE 1030 ACTIVE 7.7 . 7.2 6.6 . 6.2 GDOI_REKEY 0 ACTIVE 7.7 . 7.2 6.6 . 6.2 GDOI_REKEY 0 ACTIVE 6.6 . 6.2 5.5 . 5.2 GDOI_IDLE 1073 ACTIVE...