From stand alone to high available in Azure

[biser_todorov]

At the moment we have a stand-alone instance of FortiGate deployed in MS Azure and we need to make it high available. The plan is following this article and to deploy a cluster, then move services. 

We have ipsec tunnels on the FortiGata primarily.

What issues we may have with this approach?

[Anthony_E]

Hello biser_todorov,

I have found this document that could help you:

https://docs.fortinet.com/document/fortigate-public-cloud/6.0.0/use-case-high-availability-for-forti...

Could you please tell me if it helped?

Regards,

[biser_todorov]

I saw that article and asking here because of the "To deploy this HA, you will not launch FortiGate and other related resources from marketplace product listings. Instead, you manually kick off deployment using ARM templates."
Which means we'll have to deploy a new cluster using ARM templates and move all the ipsec tunnels. I had some bad experience in the past migrating tunnels and just wondering what to expect here. Not sure what to expect in this case as we have also Azure there.

[Anthony_E]

Hello,

Thanks a lot for this information.

We will continue to look for an answer and we will come back to you ASAP.

Regards,

[msander]

Converting a standalone Fortigate into a HA manually can be quite tricky in Cloud (especially in Azure), as it would require adding more NICs/Subnet and a SDN Connector in order to failover the PIP to the new node (plus you may need a bigger instance with 4vCPU in order to have 4 NICs in place).

You may could try to follow the steps manually as described in our Github:

https://github.com/fortinetsolutions/Azure-Templates/tree/master/FortiGate/Active-Passive%20HA

Or you could deploy it from our Github in parallel to your existing Fortigate and performing a soft migration.