Liveness detection support for VMware NSX-T service 6.4.4

The Liveness Detection feature may be used to force the VMware NSX-T service to not use a specific FortiGate device until its service managing FortiManager updates the FortiGate configuration. This is expected to be a common requirement when, for example, new FortiGates are deployed. If this is desired, the newly deployed FortiGates should not reply to liveness detection queries or forward any traffic until they have received sufficient configuration data from their service managing FortiManager. The VMware NSX-T service will use other already-configured FortiGates instead, if any are available.

When configuring a service from FortiManager to VMware NSX-T, you may set the Enable Liveness Detection setting to ON or OFF. The setting is ON by default.

To configure a VMware NSX-T service with Liveness Detection:

1. Register a service from FortiManager to VMware NSX-T. See To register a service from FortiManager to VMware NSX-T on the Creating VMware NSX-T connector page of the FortiManager 6.4.4 Admin Guide.
2. Deploy a FortiGate VM from VMware NSX-T and enable central management. See To deploy a FortiGate VM from VMware NSX-T and enable central management on the Creating VMware NSX-T connector page of the FortiManager 6.4.4 Admin Guide.
3. Add the service chain and configure the Liveness Detection setting:
   1. On the FortiManager GUI, go to Policy & Objects > Object Configurations > Fabric Connectors > Endpoint/Identity and select the added NSX-T service.
   2. Right-click on the selected service and click Configure. The Configure Devices of NSX-T Service dialog appears.
   3. Select the FortiGate device listed in the table and click Add. The Add Service Chain dialog appears.

      

   4. Toggle the Enable Liveness Detection setting to ON. It is set to ON by default.
   5. Select the appropriate options for the Service Profile and Service Chain fields as required from the drop-down lists.
   6. Click OK.
4. Configure Liveness Detection and service chain configurations on FortiGate from the CLI:

   FortiGate-VM64 # conf nsxt setting

   FortiGate-VM64 (setting) # sh fu

   config nsxt setting

   set liveness disable

   set service "<name>"

   end

   FortiGate-VM64 (setting) # set liveness enable

   FortiGate-VM64 (setting) # end

   FortiGate-VM64 #

   FortiGate-VM64 (5) # sh

   config nsxt service-chain

   edit 5

   config service-index

   edit 1

   set vd "root"

   next

   end

   next

   end

   FortiGate-VM64 (5) # end

5. Check Liveness Detection and service chain configurations on FortiManager:
   1. Go to Policy & Objects > Object Configurations > Fabric Connectors > Endpoint/Identity and select the added NSX-T service.
   2. Right-click on the selected service and click Configure. The Configure Devices of NSX-T Service dialog appears. The Liveness Detection column indicates that the setting is Enabled.

      

6. Configure a virtual wire pair interface and a virtual wire pair policy and install to FortiGate. See To complete the fabric connector setup on the Creating VMware NSX-T connector page of the FortiManager 6.4.4 Admin Guide.