Technical Tip: Resizing an AWS FortiGate-VM Active-Passive HA cluster with BYOL

[mrashidi]

Description 

This article describes how to safely resize an AWS Cloud FortiGate-VM Active-Passive HA cluster for the BYOL image, emphasizing the necessary prerequisites and step-by-step processes. The process is mostly the same in the other Cloud environments.

Scope          

AWS-FortiGate, FortiGate v7.0.x, v7.2.x, v7.4.x, v7.6.x.

Solution           

The resizing process is typically straightforward and efficient, but it is important to follow a few prerequisites:

1.  Back up the FortiGate (FGT) configuration before making any changes.
2.  Ensure that the FortiGate version is officially supported with the desired instance type.
3.  Consider the licensing implications:
• If using 'pay-as-you-go', the license will be automatically resized.
• If using 'Bring the Own License (BYOL)', check the CPU limit.

Refer to the 'FortiGate Public Cloud > AWS Admin Guide' documentation page for each version.

• Instance type support for 7.0.0
• Instance type support for 7.2.0
• Instance type support for 7.4.0
• Instance type support for 7.6.0 

Process:

1. Back up the device configuration.
2. Verify the HA settings and make sure the traffic still passing when failover happens.
3. Make sure the new licenses support the number of vCPUs of the new instance type.
1. Note: (It is still possible to install the new license either before or after changing the instance type).
4. Power off the secondary FortiGate instance (FGT-B) from the AWS console and wait for the VM status to change to 'Stopped'.
1. From Action Menu-> Instance settings, select Change instance type, select the desired new size for the VM, and select Apply.
2. Now, Start the VM instance and make sure it's up and running. 
5. On the secondary FortiGate (FGT-B) GUI, navigate to System -> FortiGuard and Select FortiGate VM License.
1. Upload (Install) the new license file; It will reboot the FortiGate.
6. Power off the primary FortiGate (FGT-A) from the AWS console, and wait for the VM status to change to 'Stopped'.
1. Note: Failover will occur and the service may go down for a few seconds, 2 or 3 request time out.
2. From Action Menu -> Instance settings select Change instance type, select the desired new size for the VM, and select Apply.
3. Start the VM instance and make sure it's up and running.
7. On the old primary FortiGate (FGT-A) GUI, navigate to System -> FortiGuard and Select FortiGate VM License.
1. Upload (Install) the new license file; It will reboot the FortiGate.

Note:

At the end of the process, the FGT-B would be the primary.

Related documents:

FortiGate-VM AWS Datasheet

AWS | Change the instance type (size)

GitHub | FortiGate-VM Terraform Deploy Code on AWS

Related article:

Technical Tip: Resizing an Azure FortiGate VM instance