Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
tim86
New Contributor

Fortigate HA over two internal switches (two core setups)

Hi!

 

I have got a fairly simple question, the situation is as following.

 

We have two core server/network-rooms inside the same building.

Each room has a FortiGate Firewall and a MikroTik or HPE core-switch.

Between these two switches we ran a 10Gbit fiber.

 

Can I setup HA (Active/Passive) on a Fortigate 70F or 80F over a VLAN between these two sever/network-rooms over the core-switches instead of directly interconnecting the heartbeat interfaces?

 

The last thing we want is issues like a split brain. How stable is a solution like this?

 

Best regards,

Tim 

 

2 Solutions
Rajneesh
Staff
Staff

Hi @tim86 

FortiGate HA setup requirement :

To successfully form an HA cluster, you must ensure that the members have the same:
• Firmware version
 Model: the same hardware model or VM model
• Licensing: includes the FortiGuard license, VDOM license, FortiClient license, and so on
• Hard drive configuration: the same number and size of drives and partitions
• Operating mode: the operating mode-NAT mode or transparent mode—of the management VDOM

 

View solution in original post

spoojary
Staff
Staff

You can configure HA (Active/Passive) on a FortiGate 70F or 80F using a VLAN over your core-switches. While this is less conventional than a direct connection, it's feasible provided the switches and the fiber link are highly reliable. The main concern is avoiding a split-brain scenario, where both units believe they're active. To mitigate this, ensure the VLAN traffic for HA is prioritized and the connection has low latency. It's crucial to monitor the setup and test failover scenarios before going live. Although this setup adds a layer of complexity, if the underlying network is reliable and you've prioritized HA traffic, it can be a robust solution. Always refer to Fortinet's documentation and consider seeking support if unsure.

Siddhanth Poojary

View solution in original post

4 REPLIES 4
saneeshpv_FTNT

Hi @tim86 ,

 

Please refer to below article on the best practices using Heart Beat interface in FortiGate FGCP cluster

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practices-for-Heartbeat-interfaces-in...

 

 

Let me know if you still have some questions.

 

Best Regards,

 

Rajneesh
Staff
Staff

Hi @tim86 

FortiGate HA setup requirement :

To successfully form an HA cluster, you must ensure that the members have the same:
• Firmware version
 Model: the same hardware model or VM model
• Licensing: includes the FortiGuard license, VDOM license, FortiClient license, and so on
• Hard drive configuration: the same number and size of drives and partitions
• Operating mode: the operating mode-NAT mode or transparent mode—of the management VDOM

 

spoojary
Staff
Staff

You can configure HA (Active/Passive) on a FortiGate 70F or 80F using a VLAN over your core-switches. While this is less conventional than a direct connection, it's feasible provided the switches and the fiber link are highly reliable. The main concern is avoiding a split-brain scenario, where both units believe they're active. To mitigate this, ensure the VLAN traffic for HA is prioritized and the connection has low latency. It's crucial to monitor the setup and test failover scenarios before going live. Although this setup adds a layer of complexity, if the underlying network is reliable and you've prioritized HA traffic, it can be a robust solution. Always refer to Fortinet's documentation and consider seeking support if unsure.

Siddhanth Poojary
tim86
New Contributor

My apologies for delayed replies, I did not receive any notifications.

Thanks for all the input! 

 

Best regards,

Tim 

Labels
Top Kudoed Authors