Fortigate 800D Failover pair.

Your backup internet connection MUST be on a different port and both connections need to be connected to both firewalls through a switch. This is in all the guides on how to set up HA, like this one: http://docs.fortinet.com/...an-with-fgcp-ha-expert HA config is fully synced, so all logical connections must be identical between cluster units.