HA setup of fortiauthenticator in 3 sites

Forum|Forum|1 year ago
September 17, 2025
5 replies
1201 views

I have 3 sites and 6 FAC vms , 2 fac in HA(active-passive) in each site is deployed. one site will be primary and other two will be secondary. can we syn config of primary site with other two site in this setup?

Best answer by magarm

Hi Debbie,

Thanks for your effort.
please help me to understand the traffic handling, can i route the traffic to loadbalancer node manually while active primary is still alive.

AEK

SuperUser

I think you need to configure them all as active-active Geo cluster, with a load balancer in which you just configure the LB rule you need.

AEK

magarmAuthor

New Member

can i make HA(active-passive) cluster as a loadbalancer?

Debbie_FTNT

Staff & Editor

Hey magarm,

in a load-balancing FortiAuthenticator cluster you can have an active-passive cluster as primary, but the actual load-balancing nodes must be standalone FortiAuthenticators, not active-passive pairs.

You can have up to ten load-balancing nodes linked to the same primary, and the primary can be an active-passive pair, so you could in theory have two separate load-balancing nodes at each site.

Please note there is no failover or promotion mechanism in a load-balancing cluster, and while most configuration can be synced, not all of it will be.

A bit of info on load-balancing setups: https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-How-to-configure-FortiAuthenticator-load-balancing/ta-p/190416

Cheers,

Debbie