Exam NSE7_EFW-7.2 topic 1 question 15 discussion

FGSP only sync sessions and it occur at L3 by default. We can move it at L2 with the set seesion-sync-dev. Configuration sync is an independant feature and occur, by default, at L2 as is part of FGCP and use hbdev command. Configuration sync can be configure to occur at L3 with the command unicast-peers, which is not the case here. If we move the sessions sync at L2, the configuration is already sync at L2 both will occur at L2. https://docs.fortinet.com/document/fortigate/7.2.7/administration-guide/84777/standalone-configuration-synchronization

I see a lot of discussion here with regards to the correct answer being either A or D. I think D is correct based on pages 113 and 118 in the Study Guide. Page 118 specifically states that Layer 2 is required for config sync in a FGSP standalone cluster configuration. And that you can enable session synchronization with layer 2 with the set session-syn-dev <interface #> command. I am a bit conflicted in the choice though, so it needs some further studying to be sure.

When peering over FGSP, by default, the FortiGate devices or FGCP clusters, share information over layer 3 between the interfaces that are configured with peer IP addresses. You can also specify the interfaces used to synchronize sessions in layer 2 instead of layer 3 using the session-sync-dev setting. When a session synchronization interface is configured and FGSP peers are directly connected on this interface, then session synchronization is done over layer 2, only falling back to layer 3 if the session synchronization interface becomes unavailable. WHAT IS UNCLAR? By def. both config and sessions are syncing via L3. If you enalbe session-syn-dev <interface> command you CREATE DEDICATED L2 connectoins for sessions sync only!! and CONFIG sync still remain in old L3 ( Heratbeat interface). exmple: config system ha set session-sync-dev port10 port12 end So if both port10 and port12 failed, session sync "return back" from L2 to original HeartBeat L3 interface. Only B is correct answer.

Session synchronization (FGSP): By default, it occurs at Layer 3. It can be moved to Layer 2 using the set session-sync-dev command, as shown in the configuration. Configuration synchronization (FGCP): It is a separate feature, independent of FGSP. By default, it operates at Layer 2 and uses the hbdev command. It can be moved to Layer 3 using the unicast-peers command, which is not configured here. Since the configuration in the exhibit moves session synchronization to Layer 2 using the set session-sync-dev command, and configuration synchronization remains at Layer 2 by default, both session and configuration synchronization will now occur at Layer 2. Correct Answer: D. To have both sessions and configuration synchronization in layer 2

Refer to study guide page 113 You can also specify the interfaces used to synchronize sessions in layer 2 INSTEAd of layer 3 using the session-sync-dev setting. When a session synchronization interface is configured and FGSP peers are directly connected on this interface, then session synchronization is done over layer 2, only falling back to layer 3 if the session synchronization interface becomes unavailable.

D is correct https://docs.fortinet.com/document/fortigate/7.2.7/administration-guide/84777/standalone-configuration-synchronization

Answer: D https://community.fortinet.com/t5/FortiGate/Technical-Tip-Suggested-Parameters-to-use-for-a-FortiGate/ta-p/230162

p113 config sync remains at the layer 3

Answer is A:To have only configuration synchronization in layer 3 p113 When peering over FGSP, by default, the FortiGate devices or FGCP clusters, share information over layer 3 between the interfaces that are configured with peer IP addresses. You can also specify the interfaces used to synchronize session in layer 2 instead of layer 3 using the "session-sync-dev" setting. When a session synchronization interface is configured and FGSP peers are directly connected on this interface, then session synchronization is done over layer 2, only falling back to layer 3 if the session synchronization interface becomes unavailable.

Session synchronization You can specify interfaces used to synchronize sessions in L2 instead of L3 using the session-sync-dev setting. For more information about using session synchronization, see Session synchronization interfaces in FGSP.

The answer is D.

https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/849059/ha-heartbeat-interface And: https://docs.fortinet.com/document/fortiweb/7.4.0/administration-guide/435480/synchronization "The configurations of the active (or primary ) node is automatically synchronized to all the members in the HA group. Synchronization ensures that all appliances in the group remain ready to process traffic, even if you only change one of the appliances. Synchronization traffic uses TCP on port number 6010 and a reserved IP address." session-sync-dev remains the traffic as layer 2. The study guide always only talks about the session sync.

The answer is D.

The answer is D. Page 113: When peering over FGSP, by default, the FortiGate devices or FGCP clusters, share information over layer 3 between the interfaces that are configured with peer IP addresses. You can also specify the interfaces used to synchronize session in layer 2 instead of layer 3 using the "session-sync-dev" setting. When a session synchronization interface is configured and FGSP peers are directly connected on this interface, then session synchronization is done over layer 2, only falling back to layer 3 if the session synchronization interface becomes unavailable.

The answer is D. Page 113: When peering over FGSP, by default, the FortiGate devices or FGCP clusters, share information over layer 3 between the interfaces that are configured with peer IP addresses. You can also specify the interfaces used to synchronize session in layer 2 instead of layer 3 using the "session-sync-dev" setting. When a session synchronization interface is configured and FGSP peers are directly connected on this interface, then session synchronization is done over layer 2, only falling back to layer 3 if the session synchronization interface becomes unavailable.

A, in a FGSP Cluster mode you can set that sessions are replicated over L2 and configuration remain in L3 with session-sync-dev:

The answer is D