Fortigate 400E HA structure

Question

Hi, Fortinet guys,

I am fully new to Fortinet products. Recently, my company purchased a pair of Fortigate 400E to set up HA structure.

May I know if the Fortigate 400E:

1. Active-active mode is good deployment for Fortigate 400E ?

1. Supports "FGCP HA with 802.3ad aggregated interfaces" ?

2. Which 2 interfaces are used/good to be deployed Heartbeat interfaces ?

Many thanks in advance.

ede_pfau · Accepted Answer

You can use any model from the 30E on upwards for a-a HA, theoretically. In practice, you will see this in midrange models, that is, 100E upwards.

Again, why would I use a-a over a-p? Both modes provide for redundancy, but a-a features load balancing. For instance, with a high number of SSLVPN clients and some other CPU intensive tasks at the same time. I wouldn't expect that when deploying low range models. Given that midrange models of the E or F series are really powerful, I don't see why I should use a-a mode here either.

YMMV, as always.

May I ask you for one favor: please do not rate posts with 1 or 2 stars; this actually reduces reputation. OK if you mean it, but I reckon the "-2...+2" rating scheme is not self-explanatory and your intention was the opposite.

So 1 star="b-s", 2 stars="plain wrong", 3 stars="why rate at all", 4 stars="helpful", 5 stars="cool!"

ede_pfau · Answer

hi,

and welcome to the forums.

Generally, I prefer a-p mode (active/passive) for stability. That does not mean that a-a mode is unreliable. In a-a mode, much more information has to be shared between cluster members, and the perceived increase in performance is not 100% but more like 40%. IMHO, if you need a-a clustering for performance your choice of hardware was inadequate in the beginning.

Second question: in general, all FGT models running the same FortiOS version support the same features. There are very few exceptions for desktop models, like not offering LACP. The 400E as a mid-range model does support HA and LACP and thus what you're asking for.

I never really bothered much about bandwidth of the HA links, and have never seen it saturated. The whole HA setup is straightforward, robust and 99% of the time set up and working. For best practice, always use more than one HA link, and I make sure I always use red cables...

Just to make it easy, first connect the cluster and then configure ports to be monitored. This makes the election process a bit quicker and more stable.

HA heartbeat (HA link) interfaces can be any interface the hardware supports, that is, "wan1" as well as "HA" as well as any SFP/SFP+ port. The FGT will create a subnet on that connection in the 169.254.x.x address range. Maybe sync traffic is even load balanced on 2 or more links.

Anyway, if you're going to employ HA you should have a good read on the HA chapter in the FortiOS Handbook. It's densely written but gives you the complete picture.

Sign up

Login with SSO

Login to the community

Login with SSO