Fortimail HA

[ByteHaven]

Hi everyone,

I would like some clarification regarding FortiMail HA in active–passive mode, specifically around IP addressing and routing/firewall configuration.

I already know how to configure HA itself, but my main question is about IP addresses:

• In an active–passive HA setup, do both FortiMail units use the same IP address, or does each unit keep a different IP address?

• I currently have a Virtual IP configured on my firewall (192.168.1.1) to forward SMTP traffic.
  At the moment, the primary FortiMail has IP 192.168.1.1(which is the VIP), and the secondary FortiMail has IP 192.168.1.2.

• SMTP traffic is currently being forwarded correctly to the primary unit.

My concern is failover behavior:

• What should be configured so that when the primary FortiMail goes down, the secondary automatically takes over?

• Once HA is configured and synchronized, does the secondary automatically take over the primary’s IP address (192.168.1.1), or do I need to modify something on the firewall side (VIP, routing, etc.)?

I want to make sure there is no mail disruption during a failover.

Thanks in advance for your help.

[AEK]

Hello BH

You use a a floating virtual IP. It will automatically move to the secondary on failover.

https://docs.fortinet.com/document/fortimail/7.2.5/administration-guide/846008/using-high-availabili...

[ByteHaven]

Hello AEK,

Maybe you'll help me more.

I'm using only two ports in my fortimails, one for the HA heartbeat and the second port for the rest (mgmt and SMTP traffic). What I wanna know is in the HA configuration > interface > virtual IP, Can i use the virtual IP I configured in my firewall and that is the same as my primary's IP add ?

BR,

[AEK]

The VIP configured in your FGT should map to the VIP you configured on your FML HA.

In your case the static IP addresses that you configured on your FMLs will be used for management, while the VIP will be used for the SMTP traffic.

[ByteHaven]

In my case the static IP add configured on my primary is used for management and smtp traffic at the same time, and that static IP add is my VIP.

Primary : port1 (used for management and smtp traffic) 192.168.1.1

VIP : 192.168.1.1

Is this configuration corrected for the HA ? Cause I am using this for my smtp traffic and it's working just fine, my concern is the HA. 

BR,