Deploying HA Firewall to current environment

[choll]

Hey everyone,

I have a question in regard to deploying a secondary HA firewall to our current environment. Since the configuration has to be the same across both firewalls. Can I just take a back up of the primary firewall, load that up to the 2nd firewall that is not plugged into anything (yes it will have the same firmware and support contract and licenses.), Change the firewall hostname, management IP, set the HA priority lower so it goes into secondary mode and deploy it.

That should work right? That way I don't have to manually go in and configure everything to be exactly the same from scratch?

[funkylicious]

Hi,

You would need only the part under, config system ha , to be configured on the 2nd firewall ( with a lower prio ) and connected to the PRI/first FW on the interfaces ( hbdev's defined in the ha config ) and everything else will be sync'ed on it from the primary ( minus some things like hostname , etc ).

[pginete]

Hi Choll,

Good day! Yes, that should work. It was mentioned on this KB https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-add-or-replace-a-unit-in-High-Avail... as option 2.

Just make sure the secondary FortiGate has the same model, firmware version, and licenses (same license date).

Thank you.

Regards,

Paulo

[nitinbhavsar]

Your approach sounds like a reasonable way to deploy a secondary HA firewall while minimizing manual configuration effort. By taking a backup of the primary firewall and restoring it onto the secondary firewall with the appropriate adjustments for hostname, management IP, and HA priority, you can ensure consistency between the two devices. However, it's important to thoroughly test the failover and HA functionality after deployment to confirm that everything is working as expected. Additionally, consider any specific requirements or best practices recommended by your firewall vendor or network security team to ensure a smooth and secure deployment.