Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
vnsc
New Contributor

Licensing HA for Firewall Fortigate

I have 2 Fortigate devices configured HA active - passive, with IPS license
Can I buy 1 IPS license for an active device? Does this have any effect on HA configuration between the 2 devices?

8 REPLIES 8
Muhammad_Haiqal

Hi @vnsc ,

There are several requirements for HA:

1. Same model

2. Same firmware version

3. Same licensing model

 

Same licensing model is required for the database/signature to sync.
In your case, if unit1 have IPS license, unit2 does not, Fortigate expected to have out-of-sync issue.
Because unit2 does not have "privilege" to have that signature.

Hope my answer clear your concern.

haiqal
AlexC-FTNT
Staff
Staff

If two units with different license models are brought in a cluster, the minimum license available in both of them is applied. So, if one has no license at all, and the other has license, the cluster will operate correctly, but without license (even if one unit has valid license).

The same is valid about dates.If one unit has a contract that expires next month, but the other unit has a contract that expires next year, then the cluster will show that the license will expire next month.


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
Toshi_Esumi
Esteemed Contributor III

Only licenses, as far as I know, can be different between HA members are FortiToken or FortiToken Mobile licenses. They can be only on one side. That causes another problem if it's on the secondary unit though. Those tokens can't be activated for users unless you swap a-p to make the unit as the primary.

 

Toshi

pavankr5
Staff
Staff

Hello @vnsc ,

 

To maintain a stable and reliable HA configuration, it is essential to ensure that both FortiGate devices have the same licenses and feature sets, including the IPS license in this case. This ensures that the active-passive failover is smooth. 

 

Thanks,

Pavan

parteeksharma

Hi vnsc,

For the proper functioning of HA cluster, it is mandatory to have same licenses on both nodes.  If only 1 node will have licenses, the dashboard on FGT will show the least licenses and might show license as expired for IPS.

Regards,
Parteek

mgoswami
Staff
Staff

Hi,

 

For HA cluster, all the devices in the cluster should have same level of licensing.

 

BR,

Manosh

YBKruthi
Staff
Staff

Hi @vnsc

 

 

Each HA unit should be licensed separately. IPS license is not shared between the HA cluster nodes.

Regards,
Kruthi

 

 

AlexC-FTNT
Staff
Staff

@vnsc and until you mark one of these answers as a solution, you will keep getting a lot of similar/identical messages for everyone who sees this unresolved


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
Labels
Top Kudoed Authors