Hi everyone, I would like some clarification regarding FortiMail HA in active–passive mode, specifically around IP addressing and routing/firewall configuration. I already know how to configure HA itself, but my main question is about IP addresses:In an active–passive HA setup, do both FortiMail units use the same IP address, or does each unit keep a different IP address?I currently have a Virtual IP configured on my firewall (192.168.1.1) to forward SMTP traffic.At the moment, the primary FortiMail has IP 192.168.1.1(which is the VIP), and the secondary FortiMail has IP 192.168.1.2.SMTP traffic is currently being forwarded correctly to the primary unit.My concern is failover behavior:What should be configured so that when the primary FortiMail goes down, the secondary automatically takes over?Once HA is configured and synchronized, does the secondary automatically take over the primary’s IP address (192.168.1.1), or do I need to modify something on the firewall side (VIP, routing, etc.)?I want to make sure there is no mail disruption during a failover. Thanks in advance for your help.

External to Fortimail:Src intf: WANDst intf: DNZSrc: ALLDst: VIP (the VIP object created at FGT level)Svc: SMTP, SMTPSFortimail to external:Src intf: DMZDst intf: WANSrc: FML_VIP (probably you'll also need to add the 2 static IP addresses as well)Dst: ALLSvc: SMTP, SMTPS

ByteHaven

Explorer III

Solved

Fortimail HA

Forum|Forum|7 months ago
January 20, 2026
10 replies
710 views

Hi everyone,

I would like some clarification regarding FortiMail HA in active–passive mode, specifically around IP addressing and routing/firewall configuration.

I already know how to configure HA itself, but my main question is about IP addresses:

In an active–passive HA setup, do both FortiMail units use the same IP address, or does each unit keep a different IP address?
I currently have a Virtual IP configured on my firewall (192.168.1.1) to forward SMTP traffic.
At the moment, the primary FortiMail has IP 192.168.1.1(which is the VIP), and the secondary FortiMail has IP 192.168.1.2.
SMTP traffic is currently being forwarded correctly to the primary unit.

My concern is failover behavior:

What should be configured so that when the primary FortiMail goes down, the secondary automatically takes over?
Once HA is configured and synchronized, does the secondary automatically take over the primary’s IP address (192.168.1.1), or do I need to modify something on the firewall side (VIP, routing, etc.)?

I want to make sure there is no mail disruption during a failover.

Thanks in advance for your help.

Best answer by AEK

External to Fortimail:

Src intf: WAN
Dst intf: DNZ
Src: ALL
Dst: VIP (the VIP object created at FGT level)
Svc: SMTP, SMTPS

Fortimail to external:

Src intf: DMZ
Dst intf: WAN
Src: FML_VIP (probably you'll also need to add the 2 static IP addresses as well)
Dst: ALL
Svc: SMTP, SMTPS

AEK

SuperUser

Hello BH

You use a a floating virtual IP. It will automatically move to the secondary on failover.

https://docs.fortinet.com/document/fortimail/7.2.5/administration-guide/846008/using-high-availability-ha#system_1547103484_2346587

AEK

ByteHavenAuthor

Explorer III

Hello AEK,

Maybe you'll help me more.

I'm using only two ports in my fortimails, one for the HA heartbeat and the second port for the rest (mgmt and SMTP traffic). What I wanna know is in the HA configuration > interface > virtual IP, Can i use the virtual IP I configured in my firewall and that is the same as my primary's IP add ?

BR,

AEK

SuperUser

The VIP configured in your FGT should map to the VIP you configured on your FML HA.

In your case the static IP addresses that you configured on your FMLs will be used for management, while the VIP will be used for the SMTP traffic.

AEK

Sign up

Login with SSO

Login to the community

Login with SSO