New Member

Solved

Load-balancer mode deployment failover

4 replies
600 views

In Load-balancer mode deployment, what happens if primary fac goes down? for an example , I have cluster(A-P) as a primary at HQ and load-balancer at two different geo location.

what happens if my primary HQ is down? can load-balancer take over authentication function.

if so which will be active.

AEKAnswer

SuperUser

There is no automated failover between them, and devices utilizing the FortiAuthenticators will need to switch to a different IP address to address a different node, as if switching to a completely independent device.

Ref: https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-How-to-configure-FortiAuthenticator-load-balancing/ta-p/190416

E.g.: if you are using RADIUS authentication, on each device you configure the first FAC as primary and the second as secondary.

You can also achieve the fail-over via a separate load-balancer (I mean LB like FortiADC). In this case the devices send the authentication request to the LB and the LB knows which FAC is up and which one is down.

AEK

AEKAnswer

SuperUser

There is no automated failover between them, and devices utilizing the FortiAuthenticators will need to switch to a different IP address to address a different node, as if switching to a completely independent device.

Ref: https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-How-to-configure-FortiAuthenticator-load-balancing/ta-p/190416

E.g.: if you are using RADIUS authentication, on each device you configure the first FAC as primary and the second as secondary.

You can also achieve the fail-over via a separate load-balancer (I mean LB like FortiADC). In this case the devices send the authentication request to the LB and the LB knows which FAC is up and which one is down.

AEK

magarmAuthor

New Member

Can the load-balancer fortiauthenticator at Branch perform authentication (MFA, SSO) of local application. or it forwards the traffic to primary cluster?

AEK

SuperUser

Yes the FAC on branch is actually intended to perform authentications for branch applications.

And no it doesn't forward the authentication traffic to the primary.

AEK

I

idumancic

Staff

hi @magarm be aware of the license part:

https://docs.fortinet.com/document/fortiauthenticator/8.0.0/administration-guide/122076/high-availability

FortiAuthenticator VMs used in a HA cluster each require a license. Each license is tied to a specific IP address. In an HA cluster, all interface IP addresses are the same on the units, expect for the HA interface.

Request each license backed on either the unique IP address of the unit's HA interface or the IP address of a non-HA interface which is the same on both units.

Sign up

Login with SSO

Login to the community

Login with SSO