Technical Tip: Active-Passive FortiGate HA Failover between two availability zones

[juvan]

Description	This article describes the behavior of a failover on a FortiGate HA cluster between two availability zones.
Scope	FortiGate HA.
Solution	FortiGate HA cluster failover between two availability zones is simpler than a failover for a cluster within the same AZ. This is because this architecture does not use secondary IP addressing. There is only one elastic IP configured for production traffic. During the failover, the elastic IP  which is assigned to port1 of FGT-1 moves to FGT-2. Accordingly, just like with the single AZ scenario, the private routing table for AZ1 is updated to forward all traffic through port2 of FGT-2 After a failover for an HA cluster between multiple availability zones, the elastic IP moves from port1 of FGT-1 to port1 of FGT-2. The private routing table for AZ1 is updated to forward all traffic through port2 of FGT-2. As with the single AZ scenario, FGT-2 initiates API calls from its dedicated HA management interface through the AWS internet gateway to perform the necessary AWS SDN updates.