[FortiGate] How to configure HA (high availability)

Firewall (UTM)

Work environment

  • FortiGate-VM
    • version 7.0.5

What is HA (High Availability)?

HA is a redundant configuration using two FortiGates.

There are Active-Passive and Active-Active configurations.

  • Active-Passive
    • One becomes Master and handles traffic. The other will be in the Slave state, and will switch to the Master state when the Master device goes down.
    • major configuration
  • Active-Active
    • Both devices are in Active state and process traffic.

Conditions for configuring HA

  • Same model number
  • Same firmware version
  • Same license

FortiGate HA Features

  • Settings are synchronized between the devices that make up HA, except for some items. for example:
    • hostname
    • HA related settings
    • Management interface settings
  • A management interface is an interface used for management access. A separate IP address can be set for the management interface. You can set a specified interface from among the physical interfaces as the management interface.
  • A virtual MAC address is used as the MAC address corresponding to the service port IP address.

Selection Criteria for Master Machines

  1. In the interface set as the monitor interface, the member with the higher number of interfaces that are up becomes Master. In the event of a tie, check the next criteria.
  2. The member with the longer HA uptime (normal operating time) becomes Master. If the difference is within 5 minutes, check the following criteria.
    • However, if the HA setting is set override enable, the HA uptime check is ignored and a master is elected based on the following priorities:
  3. The member with the higher priority becomes Master. If they are the same, check the next criteria.
  4. The member with the higher serial number becomes Master.

HA configuration procedure

Work environment

  • Here is an example of setting Active-Passive mode.

FortiGate#1 settings

◆Hostname setting

◆Interface IP address setting

Do not set an IP address for the interface that you plan to use as the management interface.

◆HA setting

HA settings are configured on the System > HA.

  • Device priority
    • The machine with the higher priority will be selected as the active machine.
  • Cluster Settings
    • Group name
      • Set any name. Use the same name on all cluster members.
    • Password
      • Set any password. Use the same password on all cluster members.
    • Session pickup
      • Sets whether to enable synchronization of session information between cluster members.
    • Monitor interfaces
      • Active machine switches when the monitor interface goes down.
    • Heartbeat interfaces
      • Interface for sending and receiving HA-related packets
  • Management Interface Reservation
    • Enable to configure the management interface.

After setting HA, the screen will be displayed as shown in the image below.

HA settings are configured with config system ha in the CLI.

config system ha
    set group-name "HA-Group"
    set mode a-p
    set password ENC PmwlwMrzGeBk1J2AeLNCRjhCC/MxKT4jDODR9KQvZvzj6R5Fzh16EjANpUzmlY34lrWk7QXtUMbNArgZp54A/D28yDU1ecJ/l/TVaEYS1duCXKwzUZjghoiWe1Y5FCMJ25a1AR3bHDJf1xMlnulsD7DcSkqUieaeW3BhPyxppU6n1+qZwE6ZgTupvtEEen5lFYQmEw==
    set hbdev "port9" 100 "port10" 200 
    set session-pickup enable
    set ha-mgmt-status enable
    config ha-mgmt-interfaces
        edit 1
            set interface "port8"
            set gateway 192.168.75.253
        next
    end
    set override disable
    set priority 200
    set monitor "port1" "port2" "port3" 
end

override can only be set in the CLI. The default for override is disable.

If override is enable, the higher priority member will automatically switch to Master when the higher priority member recovers.

◆Management interface settings

Set the management interface IP address and Administrative Access. This management interface configuration is done after HA configuration.

FortiGate#2 settings

◆Hostname setting

◆Interface IP address setting

After HA configuration, the interface settings are synchronized with FortiGate#1, so there is no need to configure them on FortiGate#2.

Do not set an IP address for the interface that you plan to use as the management interface.

◆HA setting

FortiGate#1 has Priority set to 200. For FortiGate#2 set it to 100 which is smaller.

◆Management interface settings

Set the management interface IP address and Administrative Access. This management interface configuration is done after HA configuration.

Connect Heartbeat interfaces together

After completing the HA configuration for each FortiGate, connect the Heartbeat interfaces together. Then the settings will start syncing and the cluster will be formed.

After connecting the Heartbeat interfaces, the console of FortiGate#2 shows logs similar to the following.

HA status check

You can check the HA status with the get system ha command.

FortiGate01 # get system ha status
HA Health Status: OK
Model: FortiGate-VM64
Mode: HA A-P
Group: 0
Debug: 0
Cluster Uptime: 0 days 1:2:12
Cluster state change time: 2022-09-17 22:20:25
Primary selected using:
    <2022/09/17 22:20:25> FGVMEV5APNY5IC15 is selected as the primary because its uptime is larger than peer member FGVMEV0VSUGHWQA5.
    <2022/09/17 21:40:58> FGVMEV5APNY5IC15 is selected as the primary because it's the only member in the cluster.
ses_pickup: enable, ses_pickup_delay=disable
override: disable
Configuration Status:
    FGVMEV5APNY5IC15(updated 1 seconds ago): in-sync
    FGVMEV0VSUGHWQA5(updated 3 seconds ago): in-sync
System Usage stats:
    FGVMEV5APNY5IC15(updated 1 seconds ago):
        sessions=3, average-cpu-user/nice/system/idle=2%/0%/1%/97%, memory=42%
    FGVMEV0VSUGHWQA5(updated 3 seconds ago):
        sessions=3, average-cpu-user/nice/system/idle=0%/0%/0%/100%, memory=42%
HBDEV stats:
    FGVMEV5APNY5IC15(updated 1 seconds ago):
        port9: physical/10000full, up, rx-bytes/packets/dropped/errors=3020303/6860/0/0, tx=8344329/18669/0/0
        port10: physical/10000full, up, rx-bytes/packets/dropped/errors=3503090/9311/0/0, tx=9520825/21133/0/0
    FGVMEV0VSUGHWQA5(updated 3 seconds ago):
        port9: physical/10000full, up, rx-bytes/packets/dropped/errors=8339985/18675/0/0, tx=3013425/6821/0/0
        port10: physical/10000full, up, rx-bytes/packets/dropped/errors=9516537/21139/0/0, tx=3495318/9271/0/0
MONDEV stats:
    FGVMEV5APNY5IC15(updated 1 seconds ago):
        port1: physical/10000full, up, rx-bytes/packets/dropped/errors=16422637/45849/0/0, tx=12372041/17271/0/0
        port2: physical/10000full, up, rx-bytes/packets/dropped/errors=206254/485/0/0, tx=1206/20/0/0
        port3: physical/10000full, up, rx-bytes/packets/dropped/errors=198655/1156/0/0, tx=5346/66/0/0
    FGVMEV0VSUGHWQA5(updated 3 seconds ago):
        port1: physical/10000full, up, rx-bytes/packets/dropped/errors=11258129/34482/0/0, tx=6262011/9050/0/0
        port2: physical/10000full, up, rx-bytes/packets/dropped/errors=72326/198/0/0, tx=180/2/0/0
        port3: physical/10000full, up, rx-bytes/packets/dropped/errors=104983/744/0/0, tx=3330/37/0/0
Primary     : FortiGate01     , FGVMEV5APNY5IC15, HA cluster index = 0
Secondary   : FortiGate02     , FGVMEV0VSUGHWQA5, HA cluster index = 1
number of vcluster: 1
vcluster 1: work 169.254.0.1
Primary: FGVMEV5APNY5IC15, HA operating index = 0
Secondary: FGVMEV0VSUGHWQA5, HA operating index = 1

Reset HA Uptime

The diagnose sys ha reset-uptime command allows you to reset the HA uptime for the appliance on which you run this command.

This can be used when manually switching the master unit when set override disable is set.

FortiGate Mastery Web Book
Getting Started with FortiGate How to access the GUI of factory default FortiGate Basic knowledge about configuration co...
network-knowledge.work
2021.11.01

スポンサーリンク

Comments

  1. gowtham says:
    2023-01-12 at 11:25

    both devices should need the same configuration or else if i configure any one device the configuration will synchronize with another device is it possible or not?

    Reply
Copied title and URL