Converting standalone to cluster

[SaVen]

what is the process of converting production standalone firewall to cluster? during the process will there be any interruptions to prod traffic and will this need downtime?

Thanks,

Saven

[ede_pfau]

hi,

I assume you have checked that both units are of the same hardware, and hardware revision if any. Otherwise the cluster won't form.

First you need to configure the HA parameters. Name the HA group, choose an HA ID other than the default "0" (recommended, CLI only!), select 2 (rec.!) HA heartbeat ports and leave the 'monitored' ports unchecked for the moment.

To make double sure the new unit won't take over as master (and thus clear the prod unit's config), select "HA override" in the CLI on the master ONLY, and set it's priority to, say, 200.

Do not yet select "HA mode" as "a/p" right now; if you do, the unit will have to reboot.

Do the same on the new unit except for the hostname and the override setting. Choose a priority less than on the master (less than 128 by default). Here, you can already set the HA mode to "a/p".

And yes, there will be downtime during the formation of the cluster. Remember that all MAC addresses change once you activate HA mode so this is inevitable.

Next, power down the slave. Connect the HA link(s) only, between units.

Then, select HA mode on the master and power up the slave. Master will reboot once, slave will reboot after config has been transfered.

Watch the GUI until you think the cluster has settled. This may take some minutes, like 10-15 mins. Really depends on the model.

When you're content, slave and master are synch'ed, you can connect the other ports of the slave (LAN, WAN, DMZ, whatever). You've got your switches already set up, right?

Then select the monitored ports in HA setup: if only one of these fails (link down, that is), the cluster will fail over to the other unit in an attempt to restore connectivity. Here, you only select the most important ports, say 2-3 (recently I've seen 11 ports monitored...).

While in maintenance mode, I recommend simulating a failover. Just pull one of the monitored ports' cable on the master. Failover will cost you about 5-10 pings. Everything should be identical after the failover except for the hostname of the unit you connect to.

Once you restore the monitored link the master should take over again. If you want to avoid this fail-back, set priorities equal and 'HA override disable' on both units. It's safe now, both configs are synch'ed.

You can further check that config changes are propagated to the slave. You can connect to the slave unit via SSH/Console using "exec ha manage 0".

This is the basic setup. You can add some config to protect not only to device failure or link failure but remote link failure also (using a ping host). See the Handbook for details.

And consider setting up a management port if your HW offers this. This port's config will not be synch'ed so you can watch the slave's GUI anytime.

I recommend a/p mode over a/a mode because it tends to be more stable. The performance gain of a second active cluster unit is often not overwhelming.

[roberto_araujo]

Hi Saven.

Yes, at the moment you apply the configuration, A-A or A-P the network will experience a connection lost.

Fortigate in Cluster works with a virtual Mac address, and when you you apply HA configuration, it changes interface mac address, so you must clear arp table in your swtches to recover connection in less time.

Try to show your ARP TABLE before and after applying HA configuration.

Before you must show something like 085b..... After you will see something like 0009....

Try to read this on this link.

All information are there. Trust

http://docs.fortinet.com/...7/fortigate-ha-524.pdf