1. Connecting and authorizing the FortiAP unit

Go to Network > Interfaces and edit the interface that will connect to the FortiAP (in this example, port 16).

Set Addressing Mode to Manual and set an IP/Network Mask.

Under Administrative Access, enable CAPWAP and optionally enable PING to test your connection.

Under Networked Devices, enable both Device Detection and Active Scanning.

Connect the FortiAP unit to the interface.

Go to WiFi & Switch Controller > Managed FortiAPs. The FortiAP is listed. The device is not yet authorized, as indicated by the  in the State column.

By default, FortiGate adds newly discovered FortiAPs to the Managed FortiAPs list but does not authorize them.

Right-click on the FortiAP, and select Authorize.

The device interface will be down initially, but after a few minutes, hit the Refresh button and a  will confirm that the device is authorized.

Make sure that your FortiAP is on the latest firmware. If the OS Version shows the message “A new firmware version is available,” then check the release notes for your product on the Fortinet Support Site.

You can download the firmware images from the Support Site to your Local Hard Disk, or you can select A new firmware version is available and download the latest version directly from FortiGuard.

2. Creating an SSID

Go to WiFi & Switch Controller > SSID and create a new SSID.

Set Traffic Mode to Tunnel.

Select an IP/Network Mask for the wireless interface and enable DHCP Server.

Enable Device Detection and Active Scanning.

Name the SSID (in the example, MyNewWiFi).

Set the Security Mode as required and enter a secure Pre-shared Key.

Enable Broadcast SSID.

3. Creating a custom FortiAP profile

Go to WiFi & Switch Controller > FortiAP Profiles and create a new profile.

Set Platform to the FortiAP model you are using (FAP221C in this recipe).

Set the Country/Region and you have the option to set your AP Login Password.

Make sure the Radio 1 is set to Access Point, and leave the SSID set to Auto.

Go to WiFi & Switch Controller > Managed FortiAPs and right-click on the FortiAP you added earlier. Select Assign Profile and set the FortiAP to use the new SSID profile (in the example, MyProfile).

By default, the FortiGate assigns all SSIDs to this profile.

4. Allowing wireless access to the Internet

Go to Policy & Objects > IPv4 Policy and create a new policy.

Set Incoming Interface to the SSID and Outgoing Interface to your Internet-facing interface. Confirm that NAT is enabled.

5. Results

Connect to the SSID with a wireless device. After a connection is established, browse the Internet to generate traffic.

Login to the admin page of your FortiConnect.

Go to Devices > RADIUS clients and add your WLC as a RADIUS client.

Name: Name of your WLC
Device IP: IP address of your WLC.
Secret: Choose a Shared Secret between FortiConnect and WLC)
Type: Meru SD 8.0 & Later

Go to the Automatic Setup tab and fill in the information needed for the FortiConnect to perform WLC configuration.

Device IP: IP address of your WLC
Admin user: admin username at WLC
Admin password: password of the WLC admin user
Captive Portal Name: Name that will be used to create/name the Captive Portal Profile at WLC.

This will create a RADIUS profile, a captive portal profile, and a Quality of Service (QoS) rule to allow access to the guest portal on the WLC.

The QoS rule is similar to a firewall rule, to allow the wireless device to be redirected to FortiConnect Captive Portal before the user or device is authenticated.

Click Setup Controller and FortiConnect will establish a SSH connection to the WLC.

It might take a minute or two for the actual configuration to finish.

When done you should see a message similar to this one.

Go to Devices > RADIUS Accounting Servers
and add your WLC as a radius client.

Name: Name your FortiGate
Server IP: IP address of your FortiGate (matching the interface that will listen to the RADIUS Accounting messages)
Secret: Chosse a Shared Secret between FortiConnect and Fortigate)
Accounting port: 1813

Login to WLC with admin credentials.

Go to Configuration > Security > RADIUS and validate that FortiConnect has created the two RADIUS profiles.

Validate that the automatic setup process on FortiConnect has created the two RADIUS profiles.

IDAUxxx = Authentication profile
IDACxxx = Accounting profile

Go to Configuration > Security > Captive Portal and select the Captive Portal Profiles tab.

Validate that the Captive Portal profile is created.

If needed, hit the pencil icon the edit the profile.

Go to Configuration > Security > Profile and click the ADD bottom for creating a new Security Profile.

Fill in information:

Security Profile name: Name of your security profile
Security mode: Open
Captive Portal: WebAuth
Captive Portal profile: select the profile name that’s been created earlier
Captive Portal Authentication method: external (as we use FortiConnect Portal)
Pass-through Firewall Filter ID: Matching the name from the Automatic Setup used in FortiConnect earlier
Firewall Capabilities: radius-configured (allows the WLC to use RADIUS attributes)

Go to Configuration > Wireless > ESS and click the ADD bottom for creating a new ESS profile.

Fill in information:

ESS Profile: Name the ESS profile
SSID: Name the SSID, (if left empty SSID will be same as ESS profile name)
Security Profile: Use the newly created security profile
RADIUS Accounting: Use the FortiConnect accounting profile (IDACxxxx)

Click SAVE, then accept the message that this is only for Virtual Cell AP’s (that’s what we use as the default option in WLC). Accept the message.

Login to your Fortigate with admin credentials

Go to Network > Interfaces and edit the interface that is matching the IP address added as RADIUS Acounting Server at FortiConnect.

Enable RADIUS Accounting using the check-box.

Go to User & Device > Authentication > Single Sign-On and create a new agent.

Type: RADIUS Single Sign-On Agent
Enable both Use RADIUS Shared Secret and Send RADIUS Responses.

Go to User & Device > User > User Groups and create a new user group.

Type: RADIUS Single Sign-On (RSSO)
RADIUS Attribute Value: Will match the RADIUS attribute from FortiConnect, In this example we use “staff” to identify a staff user. (remember the value is case-sensitive)

Setting RADIUS Attribute at FortiConnect for the corresponding Authorization Profile.

Attribute value used is “Class”

FortiConnect maps the user into the Account Group during the backend authentication to Microsft Active Directory.

Go to CLI of your FortiGate and edit the RSSO Agent

fw # config user radius

Then edit the RSSO entry

fw (radius) # edit RSSO\ Agent
fw (RSSO Agent) # set rsso-endpoint-attribute User-Name
fw (RSSO Agent) # end

1. Creating the data center side of the IPsec VPN

To facilitate zero touch provisioning of new spokes to establish VPNs on each data center FortiGate, this example uses dial-up VPNs with auto-discovery-sender enabled in the ADVPN configuration.

Also, add-route is disabled to support multiple dynamic tunnels to the same host advertising the same network. This dynamic discovery of the network is facilitated by the BGP configuration.

Wildcard security associations are used for phase 2 since BGP routes determine whether traffic is sent over the IPSec VPN tunnel. In this example, IPsec VPN is added to each FortiGate interface connected to the Internet.

The Phase 1 configuration includes:

• A dynamic VPN tunnel name that is 11 characters or less.
• Setting type to dynamic

• Setting interface to the Internet connected interface
• Setting peertype to any

• Setting add-route to disable

• Setting auto-discovery-sender to enable


config vpn ipsec phase1-interface
    edit "vpn-br1-1"
        set type dynamic
        set interface "vlan-3510"
        set peertype any
        set proposal aes256-sha256
        set add-route disable
        set dhgrp 5
        set auto-discovery-sender enable
        set psksecret <password>
    next
    edit "vpn-br1-2"
        set type dynamic
        set interface "vlan-3511"
        set peertype any
        set proposal aes256-sha256
        set add-route disable
        set dhgrp 5
        set auto-discovery-sender enable
        set psksecret <password>
    end

The Phase 2 configuration includes:

• Setting phase1name to the name of the phase 1 configuration
• Disabling pfs and replay

config vpn ipsec phase2-interface
    edit "vpn-br1-1_p2"
        set phase1name "vpn-isp-a"
        set proposal aes256-sha256
        set pfs disable
        set replay disable
     next
     edit "vpn-br1-2_p2"
        set phase1name "vpn-isp-b"
        set proposal aes256-sha256
        set pfs disable
        set replay disable
     end
 

2. Adding addresses to the tunnel interfaces

The BGP configuration requires IP addresses assigned to the IPsec VPN tunnel interfaces that BGP peers over. The ADVPN feature enabled by set auto-discovery-sender enable allows FortiOS to establish a point-to-multipoint connection to each FortiGate.

The IPsec VPN tunnel interface ip is set to the IP address that the tunnels will connect to, and remote-ip is set to the highest unused IP address that is part of your tunnel network. This adds two host-based routes to the FortiGate’s routing table that point directly back to the branch FortiGate.

The IPsec VPN interface configuration includes:

• Setting the ip to <vpn interface ip> 255.255.255.255
• Setting type to tunnel
• Setting remote-ip to the highest unused IP address in the VPN subnet
• Setting allowaccess to ping to allow for confirmation that a point-to-point tunnel has been established between the data center FortiGate and the branch FortiGate.

config system interface
    edit "vpn-br1-1"
        set vdom "root"
        set ip 10.254.0.1 255.255.255.255
        set allowaccess ping
        set type tunnel
        set remote-ip 10.254.0.254
        set interface "port1"
    next
    edit "vpn-br1-2"
        set vdom "root"
        set ip 10.254.1.1 255.255.255.255
        set allowaccess ping
        set type tunnel
        set remote-ip 10.254.1.254
        set interface "port2"
    end

3. Implementing route discovery with BGP

Network route discovery is facilitated by BGP and EBGP, which prevent the redistribution of routes learned that are contained in the same autonomous system number as the host. Also, EBGP influences route selection on the branches because of AS-Path prepending.

Enable ebgp-multipath to allow the FortiGate to dynamically discover multiple paths for networks advertised at branches.

Configure neighbor-range and neighbor-group to allow peering relationships to be established without defining each individual peer. The branch IPsec VPN tunnel interface addresses must be in the BGP peer range.

The BGP configuration includes:

• Enabling ebgp-multipath
• Enabling soft-reconfiguration and link-down-failover for each BGP peer in the neighbor group
• Adding the branch remote-as (which is 65501) to each peer configuration
• Setting the prefix for the neighbor range to the network matching the BGP peers
• Configuring a network with the prefix of the network advertised into BGP

To facilitate the fastest route failovers, the following timers are set to their lowest values:

• scan-time
• advertisement-interval
• keep-alive timer
• holdtime-timer

config router bgp
    set as 65500
    set router-id 10.10.0.1
    set ebgp-multipath enable
    set scan-time 5
    set graceful-restart enable
    config neighbor-group
        edit "branch-peers-1"
            set advertisement-interval 1
            set link-down-failover enable
            set soft-reconfiguration enable
            set remote-as 65501
            set keep-alive-timer 1
            set holdtime-timer 3
        next
        edit "branch-peers-2"
            set advertisement-interval 1
            set link-down-failover enable
            set soft-reconfiguration enable
            set remote-as 65501
            set keep-alive-timer 1
            set holdtime-timer 3
        next
    end
    config neighbor-range
        edit 1
            set prefix 10.254.0.0 255.255.255.0
            set neighbor-group "branch-peers-1"
        next
        edit 2
            set prefix 10.254.1.0 255.255.255.0
            set neighbor-group "branch-peers-2"
        next
    end
    config network
        edit 1
            set prefix 10.200.1.0 255.255.255.0
        next
        edit 2
            set prefix 10.200.0.0 255.255.255.0
        next
        edit 3
            set prefix 10.200.3.0 255.255.255.0
        next
    end
end

4. Controlling access to data center networks

Create firewall policies to allow users on the branch office networks to access the data center networks (behind the FortiGate). Security profiles can be added to these firewall policies to inspect of layer 7 traffic.

Include a policy on the data center FortiGate to allow a branch FortiGate to check the health of the data center FortiGate by allowing the branch FortiGate to ping the data center FortiGate IPsec VPN interface:

• Source interface: IPsec VPN interface
• Destination interface: Internal interface
• Source Address: Tunnel IP addresses of branch
• Destination Address: Data Center 1 FortiGate Internal interface
• Action: Accept
• Schedule: Always
• Service: ICMP

Policies to allow traffic from branch networks to reach data center networks should have the following firewall settings:

• Source interface: IPsec VPN interface
• Destination interface: Internal interface
• Source Address: Branch networks
• Destination Address: Date center networks
• Action: Accept
• Schedule: Always (or define a more restrictive schedule)
• Service: Allowed Service(s)

5. Pointing to branch offices with black hole routes

It is a best practice to create black hole routes with destinations set to each branch  network. If the FortiGate temporarily loses connectivity with a branch network, traffic destined to that network is sent to the black hole until connectivity has been restored.

Each Black hole route includes:

• Setting dst to the branch network IP address
• Setting the distance to 255

config router static
    edit 1
        set dst 10.0.0.0/14
        set distance 255
        set blackhole enable
    next
end

1. Creating the branch side of the IPsec VPN

Create two Phase 1 configurations, one for each data center. These configurations include:

• Setting peertype to any
• Setting remote-gw to the IP address of the data center.

config vpn ipsec phase1-interface
    edit "vpn_dc1-1"
        set interface "vlan-3000"
        set peertype any
        set proposal aes256-sha256
        set dhgrp 5
        set remote-gw 172.20.10.10
        set psksecret <password>
    next
    edit "vpn_dc1-2"
        set interface "vlan-3001"
        set peertype any
        set proposal aes256-sha256
        set dhgrp 5
        set remote-gw 172.20.11.10
        set psksecret <password>
    next
end

Create two Phase 2 configurations, one for each data center. These configurations include:

• Disabling pfs and replay
• Enabling auto-negotiate to ensure VPN establishment

config vpn ipsec phase2-interface
    edit "vpn_dc1-1_p2"
        set phase1name "vpn_dc1-1"
        set proposal aes256-sha256
        set pfs disable
        set replay disable
        set auto-negotiate enable
    next
    edit "vpn_dc1-2_p2"
        set phase1name "vpn_dc1-2"
        set proposal aes256-sha256
        set pfs disable
        set replay disable
        set auto-negotiate enable
    next
end

2. Adding IP addresses to the tunnel interfaces

To establish the point-to-multipoint IPsec VPN between the branch and the data center, the tunnel interfaces must include the following IP addresses.

The IPsec VPN Interface configuration includes:

• Setting ip to the local IP address of the VPN interface
• Setting remote-ip to the data center FortiGate’s IPsec VPN interface IP address

config system interface
    edit "vpn_dc1-1"
        set vdom "root"
        set ip 10.254.0.2 255.255.255.255
        set allowaccess ping
        set type tunnel
        set remote-ip 10.254.0.1
        set interface "wan1"
    next
    edit "vpn_dc1-2"
        set vdom "root"
        set ip 10.254.1.2 255.255.255.255
        set allowaccess ping
        set type tunnel
        set remote-ip 10.254.1.1
        set interface "wan2"
    next
end

3. Implementing route discovery with BGP

BGP allows the branch and data center FortiGates to dynamically discover routes from each other. To make this happen add the data center FortiGate IPsec VPN tunnel interface IP addresses to the branch BGP configuration as  BGP peers.

Routes that have the same network mask, administrative distance, and priority are automatically considered for SD-WAN when the interfaces where those routes are learned are added to the SD-WAN interface group.

The branch BGP configuration includes:

• Enabling ebgp-multipath
• Enabling soft-reconfiguration and link-down-failover for each BGP peer
• Adding the data center remote-as (which is 65500) to each peer configuration
• Setting the prefix for the neighbor range to the network matching the BGP peers

To facilitate the fastest route failovers, the following timers are set to their lowest values:

• scan-time
• advertisement-interval
• keep-alive timer
• holdtime-timer

config router bgp
    set as 65501
    set router-id 10.254.0.2
    set keepalive-timer 1
    set holdtime-timer 3
    set ebgp-multipath enable
    set scan-time 5
    set distance-external 1
    config neighbor
        edit "10.254.0.1"
            set advertisement-interval 1
            set link-down-failover enable
            set soft-reconfiguration enable
            set remote-as 65500
        next
        edit "10.254.1.1"
            set advertisement-interval 1
            set link-down-failover enable
            set soft-reconfiguration enable
            set remote-as 65500
        next
    end
end

4. Setting up the load balancing SD-WAN configuration

The SD-WAN configuration sets up load balancing based on link quality. Link quality is determined by health checking; which measures jitter, packet loss, and latency on each link. FortiOS dynamically creates policy routes that send traffic over the link with the highest quality.

config system virtual-wan-link
    set status enable
    config members
        edit 1
            set interface "vpn_dc1-1"
        next
        edit 2
            set interface "vpn_dc1-2"
        next
    end
end

Create SD-WAN Health-Checks for each data center network. Set server to the IP address of a server on the data center network.

config system virtual-wan-link
    config health-check
        edit "datacenter1-net"
            set server "10.200.1.1"
            set interval 1
            set failtime 1
            set recoverytime 3
        next
        edit "datacenter2-net"
             set server "10.200.2.1"
             set interval 1
             set failtime 1
             set recoverytime 3
         end
     end

Add SD-WAN Service Rules to define the criteria for the policy routes. Criteria include:

• Protocol
• Destination Address
• Source Address
• Identity Based Group
• Internet Service Definition
• Source Port
• Destination Port
• Destination Tag

To dynamically determine the networks the policy routes point to, the routes learned from a BGP neighbor are matched against a route map and matching routes are tagged. The service rules determine the routes to use based on these tags.

config system virtual-wan-link
    config service
        edit 1
            set mode priority
            set dst-tag 10
            set health-check "datacenter1-net"
            set priority-members 1 2
        next
        edit 2
             set mode priority
             set dst-tag 10
             set health-check "datacenter2-net"
             set priority-members 1 2
         next
    end
end

5. Controlling access from branch networks

Create firewall policies to allow users on the branch office networks to access the data center networks. Security profiles can be enabled on these firewall policies to inspect layer 7 traffic.

Policies to Allow traffic from the branch office to the data center networks:

• Source interface: Internal interface
• Destination interface: SD-WAN interface
• Source Address: Branch networks
• Destination Address: Data center networks
• Action: Accept
• Schedule: Always (or define a more restrictive schedule)
• Service: Allowed services

Policies to allow traffic from the data center to the branch networks:

• Source interface: SD-WAN interface
• Destination interface: Internal interface
• Source Address: Data center networks
• Destination Address: Branch networks
• Action: Accept
• Schedule: Always (or define a more restrictive schedule)
• Service: Allowed Services

1. Configuring System and Network settings

2. Adding Proxy Options to your policy

3. Creating a Proxy Policy

Go to Policy & Objects > Proxy Policy and create a transparent policy to accept the traffic that you want to apply authentication to. Set the Proxy Type to Transparent Web.

The Incoming Interface, Outgoing Interface, Destination Address, and Schedule should either match or be a subset of the source addresses defined in the IPv4 policy. Addresses added to the Source must match or be a subset of the source addresses added to the IPv4 policy. You can also add the users to be authenticated by the transparent policy to the Source Field.

 4. Results

Open a browser and generate traffic for a few minutes. Then go to FortiView > Policies.

 Configuring Inbound Disclaimer Rule

To setup the inbound disclaimer rule

1. Go to Domain & User > Domain > Domain.
2. Select the domain you wish to modify and then select Edit.
3. Expand the Advanced Settings and select the Disclaimer link.
4. Select “Use domain setting” from the Settings dropdown menu.
5. Expand Incoming and enable “Insert disclaimer at”.
6. Select “Start of message” from the dropdown menu.
7. Select Edit to create the desired message for both HTML and plain text messages, for example, “Warning – External Email”.
8. Select OK.

 Connecting to the FortiMail serial console

Local console connections to the CLI are formed by directly connecting your management computer to the FortiMail unit, using its DB-9 or RJ-45 console port.

Requirements

• a computer with an available serial communications (COM) port
• the RJ-45-to-DB-9 or null modem cable included in your FortiMail package
• terminal emulation software such as PuTTY

Note:
The following procedure describes connection using PuTTY software; steps vary with other terminal emulators.

To connect to FortiMail CLI using a local serial console connection

1. 1. Using the null modem or RJ-45-to-DB-9 cable, connect the FortiMail unit’s console port to the serial communications (COM) port on your management computer.
   2. On your management computer, start PuTTY.
   3. In the Category tree on the left, go to Connection > Serial and configure the following:
      Serial line to connect to – COM1 (or, if your computer has multiple serial ports, the name of the connected serial port)
      Bits per second – 9600
      Data bits – 8
      Parity – None
      Stop bits – 1
      Flow control – None
   4. In the Category tree on the left, go to Session (not the sub-node, Logging) and from Connection type, select Serial.
   5. Click Open.
   6. Press the Enter key to initiate a connection. The login prompt appears.
   7. Type a valid administrator account name (such as admin) and press Enter.
   8. Type the password for that administrator account then press Enter. (In its default state, there is no password for the admin account.)

1. The CLI displays the following text, followed by a command line prompt:

1.    Welcome!

1. You can now enter CLI commands.

 Basic CLI configurations

Once you’ve physically connected your computer to the FortiMail unit, you can configure the basic FortiMail system settings through the CLI. If you require more information on other CLI commands, see the FortiMail CLI Guide.

To change the admin password:

config system admin
  edit <admin_name>
    set password <new_password>
end

To change the operation mode:

config system global
  set operation_mode {gateway | server | transparent}
end

To configure the interface IP address:

config system interface
  edit <interface_name>
      set <ip_address>
end

To configure the system route/gateway:

config system route
  edit <route_int>
    set destination <destination_ip4mask>
    set gateway <gateway_ipv4>
    set interface <interface_name>
end

To configure the DNS servers:

config system dns
  set primary <ipv4_address>
  set secondary <ipv4_ address>
end

To configure the NTP time synchronization:

config system time ntp
  set ntpserver {<address_ipv4 | <fqdn_str>}
  set ntpsync {enable | disable}
  set syncinterval <interval_int>
end

To configure the SNMP v3 user settings:

config system snmp user
  edit <user_name>
    set query-status {enable | disable}
    set query-port <port_number>
    set security-level {authnopriv | authpriv | no authnopriv}
    set auth-proto {sha1 | md5}
    set aut-pwd <password>
    set status {enable | disable}
    set trap-status {enable | disable}
    set trapevent {cpu | deferred-queue | ha | ip-change | logdisk | mem | raid | remote-storage | spam | system | virus}
    set trapport-local <port_number>
    set trapport-remote <port_number>
  config host
    edit <host_no>
    set ip <class_ip>
  end
end

1. Configuring the first FortiGate (Peer-1)

Configure Peer-1 with the following settings:

Enable virtual domain configuration, add vdom1, set vdom1 to proxy mode (to support VoIP profiles), and add port 1 and port 2 to vdom1.

config system global
    set vdom-admin enable
end

config vdom 
   edit vdom1 
     config system settings
       set inspection-mode proxy
     end
   end

config system global 
   config system interface 
      edit port1 
         set vdom vdom1 
      next 
      edit port2 
         set vdom vdom1 
      end
   end

Create a virtual wire pair between port 1 and port 2.

config vdom
    edit vdom1
       config system virtual-wire-pair
          edit my-wire-pair
             set member port1 port2
          end
     end

Create a virtual wire pair policy to allow all traffic between port 1 and port 2. This example policy applies antivirus scanning, application control, and VoIP profiles.

config vdom
    edit vdom1
       config firewall policy
          edit 1
            set srcintf port1 port2
            set srcintf port1 port2
            set srcaddr all
            set dstaddr all
            set service ALL
            set schedule always
            set action allow
            set utm-status enable
            set av-profile default
            set application-list default
            set voip-profile default
         end

Configure Peer-1 for FGSP.

config system cluster-sync
    edit 1
        set peerip 10.10.10.2
        set peervd root
        set syncvd vdom1
    next
    edit 2
        set peerip 10.10.10.3
        set peervd root
        set syncvd vdom1
    next
    edit 3
        set peerip 10.10.10.4
        set peervd root
        set syncvd vdom1
    end

2. Configuring the second FortiGate (Peer-2)

Configure Peer-2 with the same configuration as Peer-1:

• Enable virtual domain configuration, add vdom1, set vdom1 to proxy mode (to support VoIP profiles), and add port 1 and port 2 to vdom1.
• Create a virtual wire pair between port 1 and port 2.
• Create a virtual wire pair policy to allow all traffic between port 1 and port 2. This example policy applies antivirus scanning, application control, and VoIP profiles.

Configure Peer-2 for FGSP.

config system cluster-sync
    edit 1
        set peerip 10.10.10.1
        set peervd root
        set syncvd vdom1
    next
    edit 2
        set peerip 10.10.10.3
        set peervd root
        set syncvd vdom1
    next
    edit 3
        set peerip 10.10.10.4
        set peervd root
        set syncvd vdom1
    end

3. Configuring the third FortiGate (Peer-3)

Configure Peer-3 with the same configuration as Peer-1:

• Enable virtual domain configuration, add vdom1, set vdom1 to proxy mode (to support VoIP profiles), and add port 1 and port 2 to vdom1.
• Create a virtual wire pair between port 1 and port 2.
• Create a virtual wire pair policy to allow all traffic between port 1 and port 2. This example policy applies antivirus scanning, application control, and VoIP profiles.

Configure Peer-3 for FGSP.

config system cluster-sync
    edit 1
        set peerip 10.10.10.1
        set peervd root
        set syncvd vdom1
    next
    edit 2
        set peerip 10.10.10.2
        set peervd root
        set syncvd vdom1
    next
    edit 3
        set peerip 10.10.10.4
        set peervd root
        set syncvd vdom1
    end

4. Configuring the fourth FortiGate (Peer-4)

Configure Peer-4 with the same configuration as Peer-1:

• Enable virtual domain configuration, add vdom1, set vdom1 to proxy mode (to support VoIP profiles), and add port 1 and port 2 to vdom1.
• Create a virtual wire pair between port 1 and port 2.
• Create a virtual wire pair policy to allow all traffic between port 1 and port 2. This example policy applies antivirus scanning, application control, and VoIP profiles.

Configure Peer-4 for FGSP.

config system cluster-sync
    edit 1
        set peerip 10.10.10.1
        set peervd root
        set syncvd vdom1
    next
    edit 2
        set peerip 10.10.10.2
        set peervd root
        set syncvd vdom1
    next
    edit 3
        set peerip 10.10.10.3
        set peervd root
        set syncvd vdom1
    end

5. Synchronizing TCP sessions

Synchronize TCP sessions so that if one of the FortiGates fails, its TCP sessions continue to be processed by the remaining FortiGates. The sessions to the failed FortiGate are redistributed by the router or load balancer. The remaining FortiGates continue to process these sessions because they have been synchronized to the session tables of all of the FortiGates in the FGSP cluster.

Enter this command on each FortiGate to synchronize TCP sessions among all of the FortiGates.

config system ha
    set session-pickup enable
end

6. Synchronizing UDP and ICMP sessions

Enter this command on each FortiGate to synchronize UDP and ICMP sessions among all of the FortiGates. You must enable TCP session synchronization to synchronize other types of sessions.

config system ha
    set session-pickup enable
    set session-pickup-connectionless enable
end

7. Synchronizing VoIP sessions

Synchronizing VoIP requires the FortiGates to automatically allow RTP sessions that should be allowed because of a previous SIP session, even if the SIP session was received by a different FortiGate. FortiOS calls these expectation sessions and synchronizing VoIP sessions requires expectation session synchronization. You can use the diagnose sys session list expectation command to display the synchronization state of expectation sessions on each FortiGate.

Enter the following command on each FortiGate to synchronize expectation sessions to support VoIP. You must enable TCP session synchronization to synchronize other types of sessions.

config system ha
    set session-pickup enable
    set session-pickup-expectation enable
end

8. Synchronizing the configuration

You can use the built-in configuration synchronization feature of FGSP to keep the configuration of all of the FortiGates synchronized. If you are using FortiManager, you can disable configuration synchronization.

Enter the following command on each FortiGate to disable configuration synchronization.

config system ha
    set standalone-config-sync disable
end

1. Allowing FortiCloud to access the local FortiConnect

On your Fortigate go to Policy & Objects > Addresses and create a new address object for FortiConnect.

Next, create an address object for FortiCloud IP used by the Captive Portal. In this example, 208.91.113.117/32 is used by apau.forticloud.com

2. Creating FortiCloud as a RADIUS client on the FortiConnect

On your FortiConnect go to Devices > RADIUS Clients and click Add RADIUS Client

Name: name the client
Device IP Address / Prefix Length: In this example, 208.91.113.117/32 is used by apau.forticloud.com
Secret: Shared Secret between FortiCloud and FortiConnect.

3. Creating FortiConnect as RADIUS Server on the FortiCloud

Open your FortiCloud account and go to AP Network > “your AP network” > Configure > My RADIUS Server.

Add My RADIUS Server in upper right corner
Name: Name the connection
Primary Server Name/IP: your wan IP
Primary Shared Secret: enter secret used between FortiCloud and FortiConnect.

4. Creating a new SSID on the FortiCloud

Go to SSIDs and click Add SSID.

SSID: Type SSID to be used
Enabled: checkmark
Captive Portal: FortiCloud Captive Portal
Sign On Method: My RADIUS server and select your RADIUS server, in this case, FortiConnect.

Tip:  You will also see a note on the IP to use for FortiCloud access.

Configure the Security, Availability and Captive Portal as needed.

5. Results

On the FortiConnect go to REPORTS & LOGS > RADIUS Authentications.

Find your successful authentication.

On your FortiCloud go to AP Network > “your AP network” > Monitor > Client.

Find the client and verify that username is present.

1. Configuring the IPsec VPN on HQ

On HQ, go to VPN > IPsec Wizard and create a new tunnel.

In the VPN Setup step, set Template Type to Site to Site and Remote Device Type to FortiGate.

In the Authentication step, set IP Address to the public IP address of the Branch FortiGate (in the example, 172.25.177.46).

After you enter the IP address, an available interface will be assigned as the Outgoing Interface. If you want to use a different interface, select it from the drop-down menu.

Set a secure Pre-shared Key.

In the Policy & Routing step, set Local Interface to LAN. The local subnet is added automatically. Set Remote Subnets to Branch’s local subnet (in the example, 192.168.13.0/24).

A summary page shows the configuration created by the wizard, including firewall addresses, static routes, and security policies.

2. Configuring the IPsec VPN on Branch

On Branch, go to VPN > IPsec Wizard and create a new tunnel.

In the VPN Setup step, set Template Type to Site to Site and Remote Device Type to FortiGate.

In the Authentication step, set IP Address to the public IP address of the HQ FortiGate (in the example, 172.25.176.142).

After you enter the IP address, an available interface will be assigned as the Outgoing Interface. If you want to use a different interface, select it from the drop-down menu.

Set a secure Pre-shared Key that was used for the VPN on HQ.

In the Policy & Routing step, set Local Interface to LAN. The local subnet is added automatically. Set Remote Subnets to HQ’s local subnet (in the example, 192.168.37.0/24).

A summary page shows the configuration created by the wizard, including firewall addresses, static routes, and security policies.

3. Results

On either FortiGate, go to Monitor > IPsec Monitor to verify the status of the VPN tunnel. Right-click under Status and select Bring Up.

A user on either of the office networks should be able to connect to any address on the other office network transparently.

If you need to generate traffic to test the connection, ping Branch’s LAN interface from a device on HQ’s internal network.

To avoid personal injury or damage to the unit, it is recommended that two or more people install the unit into the rack.

Do not place heavy objects on the unit.

1. Setting up the networks in OpenStack

From the OpenStack environment command line, enter the following commands to create network-r and network-l and the ha-sync network.

$ source overcloudrc_tenant01

$ openstack network create network-r

$ openstack subnet create subnet-r --network network-r --subnet-range 172.32.0.0/24 --dns-nameserver 208.91.112.53

$ openstack network create network-l

$ openstack subnet create subnet-l --network network-l --subnet-range 172.33.0.0/24 --dns-nameserver 208.91.112.53

$ openstack network create ha-sync

$ openstack subnet create subnet-ha --network ha-sync --subnet-range 169.254.0.0/24 --dns-nameserver 208.91.112.53

$ openstack server create --flavor m1.tiny --image cirros035 --security-group web --nic net-id=network-r  cirros-r

$ openstack server create --flavor m1.tiny --image cirros035 --security-group web --nic net-id=network-l  cirros-l

2. Deploy two FortiGate-VMs

From the OpenStack command line, enter the following commands to deploy two FortiGate-VM instances (fgt-vm-1 and fgt-vm-2). These commands use the standard license files you receive when you register your FortiGate-VMs (in this example, FGVM080000103268.lic and FGVM080000109643.lic).

$ openstack server create --flavor m1.fortigate --image fgtb1486 --user-data /home/stack/openstack/cloud-init/userdata.txt --config-drive=true --file license=/home/stack/FG-licenses/FGVM080000103268.lic --security-group web --nic net-id=private01 --nic net-id=network-r --nic net-id=network-l --nic net-id=ha-sync fgt-vm-1

$ openstack server create --flavor m1.fortigate --image fgtb1486 --user-data /home/stack/openstack/cloud-init/userdata.txt --config-drive=true --file license=/home/stack/FG-licenses/FGVM080000109643.lic --security-group web --nic net-id=private01 --nic net-id=network-r --nic net-id=network-l --nic net-id=ha-sync fgt-vm-2

Here is an example userdata.txt file used for fgt-vm-1. The userdata.txt file for fgt-vm-2 would be the same except for the hostname.

The userdata.txt file allows you to set up a FortiGate-VM with a basic default configuration customized for your environment and requirements. This example configures interfaces, adds a DNS server, and adds two firewall policies that allow any traffic to pass between the port2 and port3 interfaces. These policies make it easier to test HA failover.

In addition, the MTU of the port4 interface is set to be compatible with the OpenStack 10 environment. By default, OpenStack 10 networks have an MTU of 1446. The userdata.txt file sets the MTU of port4 to 1400. This setting is required for the HA heartbeat interfaces to be able to communicate effectively over the ha-sync network. 

#FGT VM Config File

config sys global
set hostname fgt-vm-1
end
config system interface
edit port1
set mode dhcp
set allowaccess http https ssh ping
next
edit port2
set mode dhcp
set defaultgw disable
set allowaccess http https ssh ping
next
edit port3
set mode dhcp
set defaultgw disable
set allowaccess http https ssh ping
next
edit port4
set mtu-override enable
set mtu 1400
next
end
config system dns
set primary 208.91.112.53
end
config firewall policy
edit 1
set name "Allow port2 to port3"
set dstintf "port2"
set srcintf "port3"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set nat enable
next
edit 2
set name "Allow port3 to port2"
set dstintf "port3" 
set srcintf "port2" 
set srcaddr "all" 
set dstaddr "all" 
set action accept 
set schedule "always" 
set service "ALL" 
set nat enable
end
config system central-management
set include-default-servers disable
set type fortimanager
set fmg 10.210.8.25
config server-list
edit 1
set server-type update rating
set server-address 10.210.8.25
end
end

You can use the OpenStack Horizon Networks view to verify the MTU assigned to the ha-sync network.

3. Disable port security for the FortiGate-VM and CirrOS instances

Use the RedHat OpenStack Horizon Instances view to verify the IP addresses of the FortiGate-VM, the CirrOS instances, and the networks the interfaces are connected to. For example:

From the OpenStack command line, run the following bash script to disable port security on the FG-VM interfaces.

#!/bin/bash
echo
echo 'Disable port_security on fgt-vm-1'
echo
echo
`source /home/stack/overcloudrc_tenant01`
FGT='fgt-vm-1'
IPADDR=`openstack server show $FGT | grep addresses | awk -F "|" '{print $3}' | awk -F "=" '{print $2}' | awk -F ";" '{print $1}'`
PORTID=`openstack port list | grep $IPADDR | awk -F "|" '{print $2}'`
neutron port-update $PORTID --no-security-groups --port_security_enabled=False
echo
echo $IPADDR
echo `openstack port show $PORTID`
echo
IPADDR=`openstack server show $FGT | grep addresses | awk -F "|" '{print $3}' | awk -F "=" '{print $3}' | awk -F ";" '{print $1}'`
PORTID=`openstack port list | grep $IPADDR | awk -F "|" '{print $2}'`
`neutron port-update $PORTID --no-security-groups --port_security_enabled=False`
echo
echo $IPADDR
echo `openstack port show $PORTID`
echo
IPADDR=`openstack server show $FGT | grep addresses | awk -F "|" '{print $3}' | awk -F "=" '{print $4}' | awk -F ";" '{print $1}'`
PORTID=`openstack port list | grep $IPADDR | awk -F "|" '{print $2}'`
`neutron port-update $PORTID --no-security-groups --port_security_enabled=False`
echo
echo $IPADDR
echo `openstack port show $PORTID`
echo
IPADDR=`openstack server show $FGT | grep addresses | awk -F "|" '{print $3}' | awk -F "=" '{print $5}' | awk -F ";" '{print $1}'`
PORTID=`openstack port list | grep $IPADDR | awk -F "|" '{print $2}'`
`neutron port-update $PORTID --no-security-groups --port_security_enabled=False`
echo
echo $IPADDR
echo `openstack port show $PORTID`
echo
echo 'Disable port-security on fgt-vm-2'
echo
FGT='fgt-vm-2'
IPADDR=`openstack server show $FGT | grep addresses | awk -F "|" '{print $3}' | awk -F "=" '{print $2}' | awk -F ";" '{print $1}'`
PORTID=`openstack port list | grep $IPADDR | awk -F "|" '{print $2}'`
neutron port-update $PORTID --no-security-groups --port_security_enabled=False
echo
echo $IPADDR
echo `openstack port show $PORTID`
echo
IPADDR=`openstack server show $FGT | grep addresses | awk -F "|" '{print $3}' | awk -F "=" '{print $3}' | awk -F ";" '{print $1}'`
PORTID=`openstack port list | grep $IPADDR | awk -F "|" '{print $2}'`
`neutron port-update $PORTID --no-security-groups --port_security_enabled=False`
echo
echo $IPADDR
echo `openstack port show $PORTID`
echo

IPADDR=`openstack server show $FGT | grep addresses | awk -F "|" '{print $3}' | awk -F "=" '{print $4}' | awk -F ";" '{print $1}'`
PORTID=`openstack port list | grep $IPADDR | awk -F "|" '{print $2}'`
`neutron port-update $PORTID --no-security-groups --port_security_enabled=False`
echo
echo $IPADDR
echo `openstack port show $PORTID`
echo
IPADDR=`openstack server show $FGT | grep addresses | awk -F "|" '{print $3}' | awk -F "=" '{print $5}' | awk -F ";" '{print $1}'`
PORTID=`openstack port list | grep $IPADDR | awk -F "|" '{print $2}'`
`neutron port-update $PORTID --no-security-groups --port_security_enabled=False`
echo
echo $IPADDR
echo `openstack port show $PORTID`
echo

From the OpenStack command line, associate floating IPs to the two FortiGate-VMs, by entering the following commands:

openstack server add floating ip fgt-vm-1 10.210.9.10 

openstack server add floating ip fgt-vm-2 10.210.9.14

4. Complete the FortiGate-VM configuration

From each FortiGate-VM instance CLI, enter the following commands to change the FortiGate-VM interfaces from DHCP to static, add IP addresses, and add a static route. The IP addresses assigned to the interfaces must be on the subnets of the networks the interfaces are connected to.

The example shows the fgt-vm-1 configuration. The fgt-vm-2 configuration would be the same except for the interface IP addresses.

config system interface
   edit "port1"
    set mode static
       set ip 172.31.0.3 255.255.255.0
       set allowaccess ping https ssh http
   next
   edit "port2"
    set mode static
       set ip 172.32.0.9 255.255.255.0
       set allowaccess ping https ssh http
   next
   edit "port3"
    set mode static
       set ip 172.33.0.4 255.255.255.0
       set allowaccess ping https ssh http
   next
end

config router static
   edit 1
       set gateway 172.31.0.1
       set device "port1"
   next
end

From each FortiGate-VM instance CLI, configure both FortiGate-VMs for HA. Both FortiGate-VMs must have the same HA configuation.

config system ha    
   set group-name "group-01"    
   set mode a-p    
   set password <password>    
   set hbdev "port4" 50    
   set override disable    
   set monitor "port2" 
end

5. CirrOS instance configuration

From each CirrOS CLI, configure each CirrOS instance with a default gateway that points at the FortiGate-VM interface connected to the same network as the CirrOS instance. Enter the following commands from each CirrOS CLI:

sudo route del default 
sudo ip route add default via <FG-IP-Address>

6. Testing cluster operation and failover

On the cirros-l instance console, start a continuous ping to the IP address of cirros-r. On the cirros-r instance console, start a continuous ping to the IP address of cirros-l:

On both FortiGate-VMs, use the command diagnose sniffer packet any 'icmp' 4 to sniff ICMP packets. You should only see packets going through the primary unit.

Now shut down the primary unit. You can do this from the OpenStack Horizon Instances list.

After failover, on the new primary unit enter the command diagnose sniffer packet any 'icmp' 4 to verify that the pings are now going through it.

7. Troubleshooting diagnose commands

On either FortiGate-VM you can use the diagnose sys ha status command to verify the status of the cluster.

fgt-vm # diagnose sys ha status
HA information
Statistics
    traffic.local = s:0 p:42311 b:9008646
    traffic.total = s:0 p:42316 b:9009528
    activity.fdb  = c:0 q:0

Model=80008, Mode=2 Group=0 Debug=0
nvcluster=1, ses_pickup=0, delay=0

[Debug_Zone HA information]
HA group member information: is_manage_master=1.
FGVM080000109643: Master, serialno_prio=0, usr_priority=128, hostname=fgt-vm
FGVM080000103268:  Slave, serialno_prio=1, usr_priority=128, hostname=fgt-vm

[Kernel HA information]
vcluster 1, state=work, master_ip=169.254.0.1, master_id=0:
FGVM080000109643: Master, ha_prio/o_ha_prio=0/0
FGVM080000103268:  Slave, ha_prio/o_ha_prio=1/1

fgt-vm # get system ha status
HA Health Status: OK
Model: FortiGate-VM64-KVM
Mode: HA A-P
Group: 0
Debug: 0
Cluster Uptime: 0 days 02:04:26
Cluster state change time: 2017-09-01 03:08:19
Master selected using:
   <2017/09/01 03:08:19> FGVM080000109643 is selected as the master because it has the largest value of serialno.
ses_pickup: disable
override: disable
Configuration Status:
   FGVM080000109643(updated 2 seconds ago): in-sync
   FGVM080000103268(updated 0 seconds ago): out-of-sync
System Usage stats:
   FGVM080000109643(updated 2 seconds ago):
       sessions=4, average-cpu-user/nice/system/idle=0%/0%/0%/100%, memory=55%
   FGVM080000103268(updated 0 seconds ago):
       sessions=0, average-cpu-user/nice/system/idle=0%/0%/0%/100%, memory=54%
HBDEV stats:
   FGVM080000109643(updated 2 seconds ago):
       port4: physical/10000full, up, rx-bytes/packets/dropped/errors=15043566/61878/0/0, tx=158364378/146977/0/0
   FGVM080000103268(updated 0 seconds ago):
       port4: physical/10000full, up, rx-bytes/packets/dropped/errors=29442835/61625/49/0, tx=25246662/68626/0/0
MONDEV stats:
   FGVM080000109643(updated 2 seconds ago):
       port2: physical/10000full, up, rx-bytes/packets/dropped/errors=1892/8/0/0, tx=173710/307/0/0
   FGVM080000103268(updated 0 seconds ago):
       port2: physical/10000full, up, rx-bytes/packets/dropped/errors=174390/306/0/0, tx=2352/13/0/0
Master: fgt-vm          , FGVM080000109643
Slave : fgt-vm          , FGVM080000103268
number of vcluster: 1
vcluster 1: work 169.254.0.1
Master:0 FGVM080000109643
Slave :1 FGVM080000103268

fgt-vm # diagnose sys ha checksum show
is_manage_master()=1, is_root_master()=1
debugzone
global: 33 6f ee 5b 78 a5 22 84 39 ec 36 d3 1c 54 7c 78
root: 40 0d fb 04 12 41 df ad f1 64 14 03 ff ec f5 01
all: d3 2f 6f bb a6 e7 77 db 27 75 81 b2 94 f3 fd 68

checksum
global: 33 6f ee 5b 78 a5 22 84 39 ec 36 d3 1c 54 7c 78
root: 40 0d fb 04 12 41 df ad f1 64 14 03 ff ec f5 01
all: d3 2f 6f bb a6 e7 77 db 27 75 81 b2 94 f3 fd 68

diagnose sys ha checksum show global
system.global: 2c79958c132639dfe61ab782a2f213ec
system.accprofile: 7d79452c78377be2616149264a18fd5c
system.vdom-link: 00000000000000000000000000000000
wireless-controller.inter-controller: 00000000000000000000000000000000
wireless-controller.global: 00000000000000000000000000000000
wireless-controller.vap: 00000000000000000000000000000000
system.switch-interface: 00000000000000000000000000000000
system.interface: 8690699bc33c7c15b20e017876cf1e37
...

1. Configuring the primary FortiGate

Connect to the primary FortiGate and locate the System Information Dashboard widget. Click on the System Information dashboard widget and select Configure settings in System > Settings.

Change the unit’s Host name to identify it as the primary FortiGate.

You can also enter this CLI command:

config system global
  set hostname External-Primary
end

Enter this CLI command to set the HA mode to active-passive, set a group id, group name and password, increase the device priority to a higher value (for example, 250) and enable override.

config system ha
  set mode a-p
  set group-id 25
  set group-name External-HA-Cluster
  set password
  set priority 250
  set override enable
  set hbdev port3 200 port4 100
end

Enabling override and increasing the device priority means this unit should always become the primary unit.

This command also selects port3 and port4 to be the heartbeat interfaces and sets their priorities to 200 and 100 respectively. Its a best practice to set different priorities for the heartbeat interfaces (but not a requirement).

If you have more than one cluster on the same network, each cluster should have a different group id. Changing the group id changes the cluster interface virtual MAC addresses. If your group id setting causes MAC address conflict you can select a different group id.

You can also use the GUI (System > HA) to configure most of these settings.

config system ha
  set group-id 25
  set override enable
end

The FortiGate unit negotiates to establish an HA cluster. You may temporarily lose connectivity with the FortiGate unit as FGCP negotiation takes place and the MAC addresses of the FortiGate interfaces are changed to HA virtual MAC addresses. These virtual MAC addresses are used for failover. The actual virtual MAC address assigned to each FortiGate interface depends on the HA group ID. Since this example does not involve changing the HA group ID, the FortiGate unit’s interfaces will have the following MAC addresses: 00:09:0f:09:00:00, 00:09:0f:09:00:01, 00:09:0f:09:00:02 and so on.

To reconnect sooner, you can update the ARP table of your management PC by deleting the ARP table entry for the FortiGate unit (or just deleting all ARP table entries). You can usually delete the ARP table from a command prompt using a command similar to arp -d.

To confirm these MAC address changes, you can use the get hardware nic (or diagnose hardware deviceinfo nic) command to view the virtual MAC address of any FortiGate unit interface. Depending on the FortiGate model, the output from this command could include lines similar to the following:

Current_HWaddr:   00:09:0f:09:00:00
Permanent_HWaddr  02:09:0f:78:18:c9

2. Configuring the backup FortiGate

Enter this command to reset the new FortiGate that will become the backup FortiGate to factory default settings.

execute factoryreset

You can skip this step if the new FortiGate is fresh from the factory. But if its configuration has been changed at all it is recommended to set it back to factory defaults to reduce the chance of synchronization problems.

If required, change the firmware running on the new FortiGate to be the same version as is running on the primary unit.

Register and apply licenses to the new FortiGate unit before adding it to the HA cluster. This includes licensing for FortiCare Support, IPS, AntiVirus, Web Filtering, Mobile Malware, FortiClient, FortiCloud, and additional virtual domains (VDOMs). All FortiGates in the cluster must have the same level of licensing for FortiGuard, FortiCloud, FortiClient, and VDOMs. FortiToken licenses can be added at any time because they are synchronized to all cluster members.

Click on the System Information dashboard widget and select Configure settings in System > Settings. Change the FortiGate’s Host name to identify it as the backup FortiGate.

config system global
  set hostname External-Backup
end

Duplicate the primary unit HA settings, except set the Device Priority to a lower value (for example, 50) and do not enable override.

config system ha
  set mode a-p
  set group-id 25
  set group-name External-HA-Cluster
  set password
  set priority 50
  set hbdev port3 200 port4 100
end

3. Connecting the cluster

Connect the HA cluster as shown in the network diagram. Making these connections will disrupt network traffic as you disconnect and re-connect cables.

If possible, make direct Ethernet connections between the heartbeat interfaces of the two FortiGate units.

Switches must be used between the cluster and the Internet and between the cluster and the internal networks as shown in the network diagram. You can use any good quality switches to make these connections. You can also use one switch for all of these connections as long as you configure the switch to separate traffic from the different networks.

When connected, the primary and backup FortiGates find each other and negotiate to form an HA cluster. The Primary unit synchronizes its configuration with the backup FortiGate. Forming the cluster happens automatically with minimal or no disruption to network traffic.

4. Checking cluster operation and disabling override

Check the cluster synchronization status to make sure the primary and backup units have the same configuration. Log into the primary unit CLI and enter this command:

diagnose sys ha checksum cluster

The command output lists all cluster members’ configuration checksums. If both cluster units have identical checksums you can be sure that their configurations are synchronized. If the checksums are different, wait a short while and enter the command again. Repeat until the checksums are identical. It may take a while for some parts of the configuration to be synchronized. If the checksums never become identical contact Fortinet Support to help troubleshoot the problem.

The HA Status Dashboard widget also shows if the cluster units are synchronized. Mouse over each FortiGate in the cluster to verify that they both have the same checksum.

When the checksums are identical, disable override on the primary unit (recommended).

config system ha
   set override disable
end

The HA cluster dynamically responds to network conditions. If you keep override enabled, the same FortiGate will always be the primary FortiGate. Because of this, however; the cluster may negotiate more often potentially increasing traffic disruptions.

If you disable override it is more likely that the new FortiGate unit could become the primary unit. Disabling override is recommended unless its important that the same FortiGate remains the primary unit.

From the HA Status widget, select Configure Settings in System > HA (or go to System > HA) to view the cluster status.

5. Results