We have a POC with several FGT's, all behind NAT devices with dynamic IP's.The WAN IP on the FGT is static but the NAT device in front has a dynamic IP. They will connect to an externally hosted FMG.
I did some tests and the FMG seems to be capable of handling the public IP changes.It takes between 5-6 minutes after an IP change for the FMG to see the change.
Is there some more info on this?I would like to be able to explain how the "tunnel" between the FGT and FMG works.Currently I know it's using TCP 541 with SSL/TLS encryption: High
Algorithms are: DHE-RSA-AES256-SHA:AES256-SHA: EDH-RSA-DES-CBC3-SHA: DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:AES128-SHA
Can we speed up the failover time? What is the interval it uses to connect or update the status?
Any info/detail on the connection is welcome.
You should have a look at the doc attached to Mantis #0282493.
Could you also please let us know your method to measure those 5-6 minutes?
Thank you very much for this info.It looks very useful, I will check it in further detail.
The 5-6 minutes I measured in a not so accurate method.I simulated the NAT with another FGT.
Both were around 5 minutes.