FortiGate-500 安装和配置指南 2.50

高可用性

Fortinet 通过使用冗余的硬件设备和 FortiGate 聚合协议 (FGCP)实现高可用性 (HA)的目标。HA 簇中的 FortiGate 设备全部使用完全相同的安全策略,并共享同样 的设置内容。您可以在一个 HA 簇中最多加入 32 个 FortiGate 设备。HA 簇中的每个 FortiGate 设备必须是同一型号的,并且运行同一版本的 FortiOS 固件映像。

FortiGate HA 是一种设备冗余。如果 HA 簇中的某个 FortiGate 设备出现故障而失 效,这个设备的全部功能、所有已经建立的防火墙连接和所有 IPSec VPN 会话1 将由这 个 HA 簇中的其他 FortiGate 设备维持。

在这个 HA 簇中的 FortiGate 设备使用专用的 HA 以太网接口进行簇会话信息通讯和 报告各自的系统状态。这个 HA 簇中的设备会一直进行 HA 状态信息通讯以保证 HA 簇工 作正常。因此,在这个 HA 簇中全部 FortiGate 设备的 HA 接口之间的连接必须妥善地 维护。这些通讯的任何中断都将导致不可预知的后果。

您可以连接到主 FortiGate 的任何接口去管理 HA 簇。

FortiGate 设备可以设置为以主动 - 被动 (A-P)模式或主动 - 主动 (A-A)模式 运行。NAT/ 路由模式和透明模式下的 FortiGate 设备都支持主动 - 主动模式和主动 - 被动模式的 HA。

本章提供了一个关于 HA 功能的概述,并描述了在 NAT/ 路由模式和透明模式下如何 创建一个 HA 簇。

·主动 - 被动 HA

·主动 - 主动 HA

·NAT/ 路由模式下的 HA

·透明模式下的 HA ·管理 HA 组 ·高级 HA 选项

动 - 动 HA

主动 - 被动 (A-P) 式的 HA,也可以称作热备份型的 HA,它包含了一个负责处理通 讯的主 FortiGate 设备,和一个或多个不处理通讯的附属 FortiGate 设备。附属 FortiGate 设备通过网络与主 FortiGate 设备连接。

在启动过程中,同一个 HA 簇中的成员会彼此协商,以选出一个主设备。主设备可 以允许其他 FortiGate 设备作为附属设备加入这个 HA 簇,并为每个附属设备分配优先 权。

1.HA 不能为 PPPoE, DHCP, PPTP, L2TP 服务提供会话失效恢复。

FortiGate-500 安装和配置指南

59

Page 71
Image 71
Fortinet 500 manual 高可用性, 主动 被动 Ha

500 specifications

Fortinet 500 is a next-generation firewall (NGFW) that is part of Fortinet's acclaimed FortiGate family, designed to provide advanced security for medium to large enterprises. This appliance is known for its high performance, flexibility, and ability to protect networks from a variety of cyber threats through its robust features and technologies.

One of the main features of the Fortinet 500 is its integrated security capabilities. It combines multiple security functions into a single device, allowing organizations to manage everything from intrusion prevention and antivirus to web filtering and application control. This integration leads to simplified management and increased efficiency, as users can address multiple security needs without deploying multiple devices.

The Fortinet 500 runs on the FortiOS operating system, which is known for its simplicity and user-friendliness. FortiOS provides a centralized management interface that allows for the easy configuration and monitoring of security policies across the entire network. Additionally, the Fortinet management tools, such as FortiManager and FortiAnalyzer, enable detailed insights and reporting capabilities, helping organizations stay compliant with their security mandates.

Another characteristic that sets Fortinet 500 apart is its advanced threat intelligence, powered by the FortiGuard Labs. This global threat intelligence system continuously updates the firewall with the latest threat signatures and attack vectors, ensuring that organizations stay ahead of emerging threats. The firewall also employs machine learning and artificial intelligence to detect and mitigate sophisticated attacks in real-time.

Performance is crucial in any security appliance, and the Fortinet 500 does not disappoint. With hardware acceleration and purpose-built security processors, it delivers high throughput levels, enabling organizations to maintain productivity without sacrificing security. This level of performance is particularly beneficial in environments with heavy traffic and bandwidth demands.

In addition to these core features, the Fortinet 500 supports seamless integration with other security solutions within the Fortinet Security Fabric. This comprehensive approach allows for greater visibility and control over the entire security posture of an organization.

Overall, the Fortinet 500 is a powerful NGFW that offers a blend of advanced security features, ease of management, top-notch performance, and robust threat intelligence. Its ability to adapt to the ever-evolving landscape of cybersecurity makes it a valuable asset for businesses seeking to safeguard their digital assets and ensure seamless network operation.