How to Configure FortiGate for High Availability

Introduction:

High Availability (HA) is a crucial feature for businesses that rely on continuous network security and uptime. FortiGate firewalls offer robust HA capabilities that ensure your network remains secure and available, even in the event of hardware failure or other disruptions. In this comprehensive guide, we’ll walk you through configuring FortiGate for High Availability, from understanding the basics to detailed configuration steps.

What is High Availability (HA)?

High Availability (HA) in FortiGate is a setup that provides redundancy and failover capabilities by clustering two or more FortiGate devices. The primary goal of HA is to ensure that if one device fails, another takes over automatically, minimizing downtime and maintaining network security. FortiGate supports two HA modes:

1. Active-Passive (A-P): One device is active and handles all traffic, while the other(s) remain in standby mode, ready to take over if the primary device fails.

2. Active-Active (A-A): All devices share the load and actively handle traffic. This mode is used for load balancing and providing higher throughput.

Pre-requisites for FortiGate HA Configuration

Before setting up HA, ensure the following prerequisites are met:

• Identical Models and Firmware: All FortiGate devices in the cluster must be of the same model and have identical firmware versions.
• Licenses: Each device must have a valid license.
• Network Configuration: Ensure that the devices are physically connected with the appropriate cabling for heartbeat and data traffic.
• Management IPs: Have unique management IP addresses for each FortiGate in the cluster.

Step-by-Step Guide to Configuring FortiGate HA

Here’s a detailed step-by-step guide to configuring HA on FortiGate firewalls:

Step 1: Connect FortiGates for HA

• Connect the FortiGate devices using an Ethernet cable for the HA heartbeat link. This link is critical for synchronizing data between the primary and secondary devices.
• For optimal performance, connect at least two HA heartbeat interfaces to provide redundancy.

Step 2: Access the FortiGate Web Interface

• Log in to the FortiGate primary unit using the web-based interface.
• Ensure you have administrative privileges to configure HA settings.

Step 3: Configure HA Settings on the Primary FortiGate

1. Navigate toSystem > HA.

2. Set the Mode to “Active-Passive” or “Active-Active,” depending on your requirements.

3. Assign a Device Priority: The device with the highest priority (1-255) will be the primary. Lower numbers indicate higher priority. For example, set the primary device to a higher priority (lower number).

4. Configure Group Name and Password:

   • Group Name: Choose a unique name for your HA cluster.
   • Password: Set a password for secure communication between HA devices.

5. Select HA Interfaces:

   • Choose interfaces for the heartbeat and synchronization between devices. Typically, port3 or port4 is used for HA heartbeat.

6. Session Sync: Enable session synchronization to maintain session information during a failover.

7. Override Option: Decide whether the primary device should resume control once it comes back online (Override enabled).

8. Click OK to apply the settings.

Step 4: Configure HA on the Secondary FortiGate

• Repeat the same configuration steps on the secondary FortiGate, but with a lower priority than the primary device.
• Ensure the HA group name and password match those of the primary unit.

Step 5: Verify HA Configuration

After configuring both devices, verify the HA setup:

1. Navigate toSystem > HA on the primary FortiGate.
2. Check the Cluster Information: You should see both the primary and secondary units listed with their respective roles.
3. Heartbeat Status: Verify that the heartbeat links are up and running.

Step 6: Test Failover

To ensure HA is functioning correctly, perform a failover test:

1. Simulate a Failover: Disconnect the primary unit or shut down its power.
2. Observe the Failover: The secondary device should take over automatically.
3. Check Network Continuity: Verify that network services remain uninterrupted during the failover.

Step 7: Monitor HA Status and Logs

• Use the FortiGate GUI or CLI commands to monitor the HA status regularly.
• CLI Command: Use get system ha status to view detailed HA cluster information.
• Regularly check logs for any HA-related events to preemptively address potential issues.

Best Practices for FortiGate HA Configuration

1. Redundant Heartbeat Links: Use multiple heartbeat links to prevent single points of failure.
2. Regular Firmware Updates: Keep all devices in the HA cluster updated to the latest firmware versions.
3. Monitor Health Status: Regularly monitor the health and status of each HA member to ensure optimal performance.
4. Document Configuration: Maintain detailed documentation of your HA setup, including device priorities, IP addresses, and interface assignments.

Conclusion

Configuring FortiGate for High Availability is an effective way to enhance the resilience and reliability of your network security infrastructure. By following the steps outlined in this guide, you can set up a robust HA configuration that minimizes downtime and ensures continuous protection against network threats. Regularly monitor and maintain your HA setup to adapt to changing network demands and keep your security posture strong.