FortiGate HA Cluster

This is a step-by-step tutorial for configuring a high availability cluster (active-standby) with two FortiGate firewalls. Since almost all firewall vendors have different principles for their HA cluster, I am also showing a common network scenario for Fortinet.

I am using two FortiWiFi 90D firewalls with software version v5.2.5,build701. The official Fortinet documentation for “High Availability with two FortiGates” can be found here.

Network Layout

FortiGate HA NetworkBasically, all interfaces must be connected with layer-2 switches among both firewalls. (In my lab, these are the wan1 and internal1 ports.) Furthermore, two directly connected interfaces should be used for the HA heartbeats. If the firewall has no dedicated HA interfaces, any unused interfaces can be used instead. (In my lab, I am using ports internal13 and internal14 for the heartbeats on my FortiWiFi-90D firewalls.)

The crucial point is the out-of-band management for accessing both firewalls independent of their HA state. Fortinet has the feature of the “Management Port for Cluster Member“, which must be set during the initial HA process. This interface must be unused to that point and can be configured later with an IP address within the same IP subnet as an already used interface. (In my lab, I am using the internal12 ports for the management ports.)

Screenshot Guide

Note: Before cabling the HA cluster, you should configure both units and then power off (!) the secondary one. Then connect the HA heartbeat interfaces and power on the secondary unit again. This ensures that the primary unit will stay the primary (since it has the longer uptime) and syncs its configuration to the secondary one.

Following are the screenshots for this HA cluster guide. Note the descriptions under each screenshot:

The following two pictures show the physical units after the HA configuration. On the first picture, the HA cluster was not cabled, while on the second, it was. Note the green HA LED:

Via the CLI, the diagnose ha sys status  command can be used to investigate the cluster:

Featured image <Untitled> by daspunkt is licensed under CC BY 2.0.

14 thoughts on “FortiGate HA Cluster

  1. Hi,

    What IP address do you use on the slave unit for the wan & internal interfaces? Do you leave them blank?

    1. Hi Ed,

      I don’t use any further IP addresses on the other links. Only the ones explained for the management.

      The data interfaces still have only their single IP address which floats between the deviced, dependent which of them is currently active.

    2. It’s use the same IP Address as Master. Just leave slave there it’s will syncing by automatically

  2. Hi,

    Your firewall is in HA mode, but a single switch is the point of failure. My question is how connect/configure two firewall(HA) to two switch/coreswitch ? I can do it with stacking/chassis technology to make two physical switch look like 1 switch, but stacking/technology is a single control plane which mean if i upgrade the switch i must reboot the two switch, theres is another technology M-LAG/MC-LAG, it provide active-active link it survive upgrade because its seperate control plane but the switch is not a ‘single logical switch’. Whats your advice about firewall ha to two switch ?

    Thx

    1. Hi Ibrahim,

      yes, you are correct that the switch (e.g., the one facing to the Internet) is a single point of failure. You should you two switches, both connected to each other and both (!) connected to the ISP router, or the like.
      Then you are conneting the “left” firewall to the “left” switch, and the “right” firewall to the “right” switch. Now, if a switch is dead, the firewall cluster will change its active/passive state and will work with the other switch.

  3. Hi Johannes,
    nice information for HA cluster with Fortigate.
    The recommendation from Fortinet is to give the different units different values of priority. You use the default value of 128 in your example.
    With my experience (four HA custers at several locations) I agree the recommendation and more, I change 128 on both units.
    With this we never had a problem when we had to change a unit because of hardware problems.
    If you run several vDoms, you can configure which vDom runs on which unit. That’s very nice to use the power of all units in a active-passive cluster…

  4. I am in the process of setting up 2 FortiGate 500D units in HA active-passive. Can the passive unit host other tunnels while it’s waiting for the primary unit to develop problems? The OS is 5.4.0 Build 1011

    1. Hi Paul,

      no, the passive unit is really “passive”, that is, it does nothing until it becomes active. You can only configure/troubleshoot on the current active unit.

  5. Hi
    Are there fortigate fir Wan use the same ip address??
    And for Lan (internal) too same the ip address?

    1. Hi Erlianto,

      the IP addresses used on all data interfaces are exactly the same. But of course only active on the active unit. If a failover occurs, the IP addresses will be active on the other (formerly passive) unit.
      The only exception are the IP addresses on the port configured as “Reserve Management Port for Cluster Member” as shown in my screenshots above.

  6. Hi Johannes,

    Great post,

    Why in the passive unit you only check one of the wan port and no both in the monitor ports section of HA configuracion?

    1. Uh, good question. This was ONLY related to my lab since I had no wan2 cable connected on the passive unit. ;) If you have all your ports connected on both units, than you should monitor all of them as well. And of course on both units.
      Sorry for that.

Leave a Reply

Your email address will not be published. Required fields are marked *