FortiAuthenticator High Availability Active-Passive Design/Behavior

Forum|Forum|7 months ago
January 27, 2026
2 replies
314 views

I'm trying to design topology for a 2 FortiAuthenticator system (in geographically separate areas) with Active-Passive HA.

Can multiple interfaces be configured for the heartbeat in case one pair of interfaces goes down (e.g. a cut cable)?

Can an interface that is configured for authentication also be used for heartbeat?

What happens if the heartbeat(s) go down but both FAC are still online? Will there be split brain? How is a split brain resolved?

AEK

SuperUser

1. There is only one HB interface. I know usually in cluster configurations we always recommend at leat 2 interfaces, but in FAC there is only one and this I think Fortinet should resolve this limitation.

2. In the official doc you can't use an interface as HB if it already has an IP address.

3. I case of HB disconnection, as for any cluster behavior I guess you will have split brain, and probably IP conflict.

AEK

I

idumancic

Staff

Hi @rickas27 , check this:

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-How-to-configure-FortiAuthenticator-load-balancing/ta-p/190416

Sign up

Login with SSO

Login to the community

Login with SSO