FortiGate HA Active-Active mode

[fjulianom]

Hi experts,

In my work I have never seen two FortiGates in HA Active-Active mode, always Active-Passive mode. There is documentation for both modes, but the Active-Passive is always more common. According to me Active-Active mode is better since it provides redundancy, like Active-Passive, and also load balancing, unlike Active-Passive, which I guess it enhances the performance of the two FortiGates. Why is Active-Passive mode more common? Is there any downside of using Active-Active mode?

Many thanks in advance,

Julián 

[emnoc · Accepted solution]

So where do I start ;)

1st

Active-Active does not provide load-balancing for ALL sessions ( you will not gain LB unless you had security-profiles and proxy  profiles enable for all traffic types )

2nd

Active-Standby is the more simple approach and yes offers hit-less failover if session replication is done  ( SSLVPN is ????s and will take a hit  btw )

3rd

if you have  multi-vdom, vcluster1+2 is  more widely supported and achieve load-sharing across both units in multi-vdom

[emnoc · Accepted solution]

http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-high-availability/HA_FGCP.htm

Go down to section load-balance, in v5.4 and newier is slightly better, but just enabling "A-A" is  not going to give you 50/50 load-balance. Some session an traffic will always stay on the "master" unit. You can monitor session counts across the HA cluster to validate this YMMV.

Also google "set load-balance-all" fortigate

[emnoc · Accepted solution]

So where do I start ;)

1st

Active-Active does not provide load-balancing for ALL sessions ( you will not gain LB unless you had security-profiles and proxy  profiles enable for all traffic types )

2nd

Active-Standby is the more simple approach and yes offers hit-less failover if session replication is done  ( SSLVPN is ????s and will take a hit  btw )

3rd

if you have  multi-vdom, vcluster1+2 is  more widely supported and achieve load-sharing across both units in multi-vdom

[fjulianom]

Hi Emnoc,

Thanks for you interest. I didn't know these three points. Could you please clarify the first point? It is not clear to me yet.

Regards,

Julián

[emnoc · Accepted solution]

http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-high-availability/HA_FGCP.htm

Go down to section load-balance, in v5.4 and newier is slightly better, but just enabling "A-A" is  not going to give you 50/50 load-balance. Some session an traffic will always stay on the "master" unit. You can monitor session counts across the HA cluster to validate this YMMV.

Also google "set load-balance-all" fortigate

[emnoc · Accepted solution]

and  review this, this FTNT on document on HA  A-A and with tcp traffic

http://kb.fortinet.com/kb...D31790&languageId=

[fjulianom]

Hi Emnoc,

Many thanks, I will check those documents.

Regards,

Julián