In this recipe, a backup FortiGate unit will be installed and connected to a previously installed primary FortiGate to provide redundancy if the primary FortiGate fails.
This recipe is part of the Cooperative Security Fabric collection. It can also be used as a standalone recipe.
This setup, called FortiGate High Availability (HA), improves network reliability. The previously installed FortiGate will continue to operate as the primary unit and the new FortiGate will operate as the backup FortiGate.
Find this recipe for other FortiOS versions
5.2 | 5.4
1. Setting up registration and licensing |
|
|
Make sure both FortiGates are running the same FortiOS firmware version. Register and apply licenses to the new FortiGate unit before adding it to the cluster. This includes activation of FortiCloud and licenses for FortiGuard, FortiSandbox, FortiClient, and FortiToken, as well as entering a license key if you purchased more than 10 Virtual Domains (VDOMS). |
 |
|
You can also install any third-party certificates on the primary FortiGate before forming the cluster. Once the cluster is formed third-party certificates are synchronized to the backup FortiGate. |
|
2. Configuring the Primary FortiGate for HA |
|
|
Connect to the primary FortiGate GUI and from the System Information Dashboard widget change the Host Name to identify this as the primary FortiGate in the HA cluster. |
 |
|
Also on the System Information widget, configure HA Status (or go to System > HA). Set the Mode to Active-Passive. Set the Device Priority to a higher value than the default to make sure this FortiGate will always be the primary FortiGate. Also set a Group Name and Password. Make sure that the two Heartbeat Interfaces (port3 and port4) are enabled and their priorities are both set to 50. Since the backup FortiGate is not available, when you save the HA configuration the primary FortiGate will form a cluster of one FortiGate but will keep operating normally. |
 |
3. Connecting the backup FortiGate |
|
|
Connect the backup FortiGate to the primary FortiGate and the network as shown in the network diagram at the top of the recipe. Making these network connections will disrupt traffic so you should do this when the network is quiet. If possible, make direct Ethernet connections between the heartbeat interfaces of the two FortiGate units. Switches must be used between the cluster and the Internet and between the cluster and the internal networks as shown in the network diagram. You can use any good quality switches to make these connections. You can also use one switch for all of these connections as long as you configure the switch to separate traffic from the different networks. |
 |
4. Configuring the backup FortiGate for HA |
|
|
Connect to the backup FortiGate GUI and from the System Information Dashboard widget change the Host Name to identify this as the backup FortiGate. |
 |
|
Also on the System Information widget, configure HA Status (or go to System > HA) and duplicate the HA configuration of the primary FortiGate (except for the Device Priority): set the Mode to Active-Passive, set the Device Priority to a lower value than the default to make sure this FortiGate will always be the backup FortiGate. Also set the same Group Name and Password as the primary FortiGate. Make sure that the two Heartbeat Interfaces (port3 and port4) are enabled and their priorities are both set to 50. When you save the backup FortiGate’s HA configuration, the FortiGates will find each other and form a cluster of two FortiGates. Network traffic may be disrupted for a few seconds while the cluster is negotiating. |
 |
5. Viewing the cluster status |
|
| Connect to the primary FortiGate GUI. The System Information widget displays the HA status and some information about the cluster. For example, the System Information widget can indicate when the configurations of the cluster units in not synchronized. |  |
| From on the System Information widget, select HA Status (or go to System > HA) to view the cluster status. |  |
| Select View HA Statistics for more information on how the cluster is operating and processing traffic. |  |
6. Results |
|
|
Traffic is now passing through the primary FortiGate. However, if the primary FortiGate becomes unavailable, traffic should failover and the backup FortiGate will process traffic. Failover also causes the primary and backup FortiGate to reverse roles, even when both FortiGates are available again. |
|
| To test this, ping the IP address 8.8.8.8 using a PC on the internal network. After a moment, power off the primary FortiGate. You will see a momentary pause in the ping results, until traffic diverts to the backup FortiGate, allowing the ping traffic to continue. |  |
7. (Optional) Upgrading the firmware for the HA cluster |
|
|
When a new version of the FortiOS firmware becomes available, upgrading the firmware on the primary FortiGate automatically upgrades the backup FortiGate’s firmware. Both FortiGates are updated with minimal traffic disruption. Always review the Release Notes and Supported Upgrade Paths documentation before installing new firmware. These documents can be found at the Fortinet Document Library. |
|
| From the System Information widget, select Backup beside System Configuration. Always remember to back up your configuration before upgrading the firmware. |  |
| From the System Information widget select Upgrade beside Firmware Version. Find the firmware image file that you downloaded and select OK to upload and install the firmware build.
The firmware loads onto both the primary and the backup FortiGates with minimal traffic interruption. |
 |
| After the upgrade is process is complete, verify that the System Information widget shows the new firmware version. |  |
For further reading, check out FGCP configuration examples and troubleshooting in the FortiOS 5.4 Handbook.
The post High Availability with two FortiGates appeared first on Fortinet Cookbook.