Migrating HA Type in Azure

Hi,

Yes, moving from an Active-Active HA deployment to an Active-Passive HA deployment in Azure is possible, but I would treat this as an architecture change rather than simply changing the HA mode on the FortiGate.

In the Azure Active-Active design, the two FortiGate-VMs operate as independent systems and the Azure external and internal Load Balancers handle traffic distribution and failover. In an Active-Passive design, the FortiGate-VMs form an FGCP HA cluster, with one unit acting as primary and the other as secondary.

If you want to remove the Azure Load Balancers, one option is to use the Azure SDN Connector for the Active-Passive design. During a failover, the passive FortiGate becomes active and can use Azure API calls to move the required public IP addressing and update the relevant User Defined Routes to point to the new primary.

Therefore, I would review the following before making the change:

• The current Azure Load Balancer configuration and which traffic flows depend on it.
• The current public IP and UDR design.
• The FortiGate HA configuration and synchronization requirements.
• The Azure permissions required by the SDN Connector. The SDN Connector requires appropriate Azure permissions, such as Network Contributor access or an equivalent custom role, to update the required resources during failover.
• Any Azure resources or services currently using the Load Balancer frontend IPs, backend pools, health probes, or related configuration.

Regarding your question about the SDN Connector: it is a FortiGate/Azure integration capability, not an additional Azure Load Balancer. However, the Azure resources and services you choose to use around the solution can have their own Azure charges, so I would confirm the resulting Azure architecture and associated costs before making the change.

In short, the migration is possible, but I would first design the target Active-Passive architecture with the SDN Connector and map the current Load Balancer functions to their Active-Passive equivalents before removing the Load Balancers.

Hope this helps clarify the migration path.