高可用性

高级 HA 选项

 

 

一旦重新配置或者更换了新的 FortiGate 设备,需要改变它的 HA 配置以与原来失 效的 FortiGate 的配置相匹配。然后把它重新连接到网络中。这个 FortiGate 将自动 地加入 HA 组中。

高级 HA 选项

可以从 FortiGate CLI 使用以下 HA 高级选项:

从 FortiGate 设备中选择一个主设备

在一个典型的 FortiGate 簇配置中,主设备的选择过程是自动的。HA 簇每次启动 之后选定的主设备都可能不同。此外作为主设备运行的 FortiGate 设备也可能会改变 (例如,如果当前的主设备重新启动,另一个设备可能会代替它成为主设备)。

在某些情况下,您可能希望控制哪一个设备最终成为主设备。您可以将一个 FortiGate 设备配置为主设备,只需要修改这个设备的优先级使它能控制其他设备。

当簇中的 FortiGate 设备协商主设备的时候,总是拥有最低优先权的设备成为主设 备。如果两个设备有同样的优先权,则使用标准的协商过程选择主设备:

以下操作将一个 FortiGate 设备配置为 HA 簇中的永久性的主设备:

1 连接到永久性主 FortiGate 设备的 CLI。

2 设置永久主设备的优先级。输入:

set system ha priority < 优先级 _ 整数 >

<优先级 _ 整数 > 是永久主设备要设置的优先级。优先级最低的设备将成为主设备。默 认的优先级 128。将永久性主设备的优先级设置为一个小于 128 的数。

例如,将永久性主设备的优先级设置为 10,使用如下命令:

set system ha priority 10

3 确保这个簇中的其他所有设备的优先级高于这个永久性主设备的优先级。 get system ha mode 命令显示您当前连接到的 FortiGate 设备的优先级。

4 当永久性主设备加入簇时覆盖一个现有的主设备的设置,使用如下命令:

set system ha override enable

启用覆盖可以使永久性主设备总是能够覆盖其他主设备的设置。例如,如果永久性主 设备关机,簇中的其他另一个设备将代替它成为主设备。当永久性主设备重新启动后, 如果它启用了覆盖,它将再次成为主设备。

配置加权轮询的权重

默认情况下,主动 - 主动 HA 模式的加权轮询调度为这个簇中的每个 FortiGate 设 备分配相同的权重。一旦这个簇被配置为加权轮询调度,您可以使用 set system ha weight 命令为簇中的每个设备配置权重。权重的值设置了在连接被发送到下一个设备 之前,发送到这个设备的最大连接数。您可以通过设置权重值来控制每个簇设备能处 理的连接数。这项技术的一个用处就是减少主簇设备处理的连接数,只需增加分配给 其他附属簇设备的权重。

权重值根据簇中的设备优先级的次序设置。例如,如果您有一个包含了 3 个 FortiGate 设备的 HA 簇,您可以输入以下命令配置每个设备的权重:

set system ha weight 1 3 3

FortiGate-500 安装和配置指南

73

Page 85
Image 85
Fortinet 500 高级 Ha 选项, FortiGate 设备中选择一个主设备, 配置加权轮询的权重, 可以从 FortiGate CLI 使用以下 HA 高级选项:, 例如,将永久性主设备的优先级设置为 10,使用如下命令:

500 specifications

Fortinet 500 is a next-generation firewall (NGFW) that is part of Fortinet's acclaimed FortiGate family, designed to provide advanced security for medium to large enterprises. This appliance is known for its high performance, flexibility, and ability to protect networks from a variety of cyber threats through its robust features and technologies.

One of the main features of the Fortinet 500 is its integrated security capabilities. It combines multiple security functions into a single device, allowing organizations to manage everything from intrusion prevention and antivirus to web filtering and application control. This integration leads to simplified management and increased efficiency, as users can address multiple security needs without deploying multiple devices.

The Fortinet 500 runs on the FortiOS operating system, which is known for its simplicity and user-friendliness. FortiOS provides a centralized management interface that allows for the easy configuration and monitoring of security policies across the entire network. Additionally, the Fortinet management tools, such as FortiManager and FortiAnalyzer, enable detailed insights and reporting capabilities, helping organizations stay compliant with their security mandates.

Another characteristic that sets Fortinet 500 apart is its advanced threat intelligence, powered by the FortiGuard Labs. This global threat intelligence system continuously updates the firewall with the latest threat signatures and attack vectors, ensuring that organizations stay ahead of emerging threats. The firewall also employs machine learning and artificial intelligence to detect and mitigate sophisticated attacks in real-time.

Performance is crucial in any security appliance, and the Fortinet 500 does not disappoint. With hardware acceleration and purpose-built security processors, it delivers high throughput levels, enabling organizations to maintain productivity without sacrificing security. This level of performance is particularly beneficial in environments with heavy traffic and bandwidth demands.

In addition to these core features, the Fortinet 500 supports seamless integration with other security solutions within the Fortinet Security Fabric. This comprehensive approach allows for greater visibility and control over the entire security posture of an organization.

Overall, the Fortinet 500 is a powerful NGFW that offers a blend of advanced security features, ease of management, top-notch performance, and robust threat intelligence. Its ability to adapt to the ever-evolving landscape of cybersecurity makes it a valuable asset for businesses seeking to safeguard their digital assets and ensure seamless network operation.