Licensing HA for Firewall Fortigate

Hi @vnsc ,

There are several requirements for HA:

1. Same model

2. Same firmware version

3. Same licensing model

Same licensing model is required for the database/signature to sync.
In your case, if unit1 have IPS license, unit2 does not, Fortigate expected to have out-of-sync issue.
Because unit2 does not have "privilege" to have that signature.

Hope my answer clear your concern.

If two units with different license models are brought in a cluster, the minimum license available in both of them is applied. So, if one has no license at all, and the other has license, the cluster will operate correctly, but without license (even if one unit has valid license).

The same is valid about dates.If one unit has a contract that expires next month, but the other unit has a contract that expires next year, then the cluster will show that the license will expire next month.

Only licenses, as far as I know, can be different between HA members are FortiToken or FortiToken Mobile licenses. They can be only on one side. That causes another problem if it's on the secondary unit though. Those tokens can't be activated for users unless you swap a-p to make the unit as the primary.

Toshi

Hello @vnsc ,

To maintain a stable and reliable HA configuration, it is essential to ensure that both FortiGate devices have the same licenses and feature sets, including the IPS license in this case. This ensures that the active-passive failover is smooth. 

Thanks,

Pavan

Hi vnsc,

For the proper functioning of HA cluster, it is mandatory to have same licenses on both nodes.  If only 1 node will have licenses, the dashboard on FGT will show the least licenses and might show license as expired for IPS.

Regards,
Parteek

Hi,

For HA cluster, all the devices in the cluster should have same level of licensing.

BR,

Manosh

Hi @vnsc, 

Each HA unit should be licensed separately. IPS license is not shared between the HA cluster nodes.

Regards,
Kruthi

@vnsc and until you mark one of these answers as a solution, you will keep getting a lot of similar/identical messages for everyone who sees this unresolved