Configuring the FortiControllers

1. Connect to the GUI (using HTTPS) or CLI (using SSH) of the FortiController in slot 1 using the default IP address 192.168.1.99.

   Or connect to the FortiController CLI through the console port (Baud Rate 9600bps, Data bits 8, Parity None, Stop bits 1, and Flow Control None).

2. Login using the admin administrator account and no password.

3. Add a password for the admin administrator account. From the GUI use the Administrators widget or from the CLI enter this command.

   config admin user

   edit admin

   set password <password>

   end

4. Change the FortiController mgmt interface IP address.

   From the GUI use the Management Port widget or from the CLI enter this command:

   config system interface

   edit mgmt

   set ip 172.20.120.151/24

   end

5. If you need to add a default route for the management IP address, enter this command.

   config route static

   edit route 1

   set gateway 172.20.120.2

   end

6. Set the chassis type that you are using, for example:

   config system global

   set chassis-type fortigate-5140

   end

7. Configure active-passive HA on the FortiController in slot 1. From the FortiController GUI System Information widget, beside HA Status select Configure.

8. Set Mode to Active-Passive, change the Group ID, and move the b1 and b2 interfaces to the Selected column and select OK.

   

   You can also enter the following from the CL:

   config system ha

   set mode a-p>

   set groupid 23

   set hbdev b1 b2

   end

   If you have more than one cluster on the same network, each cluster should have a different Group ID. Changing the Group ID changes the cluster interface virtual MAC addresses. If your group ID setting causes a MAC address conflict you can select a different Group ID. The default Group ID of 0 is not a good choice and normally should be changed.

   You can also adjust other HA settings. For example, you could increase the Device Priority of the FortiController that you want to become the primary unit, enable Override to make sure the FortiController with the highest device priority becomes the primary unit, and change the VLAN to use for HA heartbeat traffic if it conflicts with a VLAN on your network.

   You would only select Enable chassis redundancy if your cluster has more than one chassis.

9. Log into the GUI of the FortiController in slot 2 and duplicate the HA configuration of the FortiController in slot 1, except for the Device Priority and override setting, which can be different on each FortiController.

   After a short time, the FortiControllers restart in HA mode and form an active-passive cluster. Both FortiControllers must have the same HA configuration and at least one heartbeat link must be connected.

   Normally the FortiController in slot 1 is the primary unit, and you can log into the cluster using the management IP address you assigned to this FortiController.

10. Confirm that cluster has been formed by viewing the HA configuration from the FortiController GUI. The display should show both FortiControllers in the cluster.

    Since the configuration of all FortiControllers is synchronized, you can complete the configuration of the cluster from the primary FortiController.

    

11. Go to Load Balance > Status see the status of the cluster.

    This page should show both FortiControllers in the cluster. The FortiController in slot 1 is the primary unit (slot icon colored green) and the FortiController in slot 2 is the secondary unit (slot icon colored yellow).

    

12. Go to Load Balance > Config to add the workers to the cluster by selecting Edit and moving the slots that contain workers to the Members list.

    The Config page shows the slots in which the cluster expects to find workers. If the workers have not been configured yet their status will be Down.

13. Configure the External Management IP/Netmask. Once you have connected workers to the cluster, you can use this IP address to manage and configure them.

    

    You can also enter the following CLI command to add slots 3, 4, and 5 to the cluster:

    config load-balance setting

    config slots

    edit 3

    next

    edit 4

    next

    edit 5

    end

    end

    You can also use the following CLI command to configure the external management IP/Netmask and management access to this address:

    config load-balance setting

    set base-mgmt-external-ip 172.20.120.100 255.255.255.0

    set base-mgmt-allowaccess https ssh ping

    end

14. Enable base management traffic between FortiControllers. The CLI syntax shows setting the default base management VLAN (101). You can also use this command to change the base management VLAN.

    config load-balance setting

    config base-mgmt-interfaces

    edit b1

    set vlan-id 101

    next

    edit b2

    set vlan-id 101

    end

    end

15. Enable base control traffic between FortiControllers. The CLI syntax shows setting the default base control VLAN (301). You can also use this command to change the base management VLAN.

    config load-balance setting

    config base-ctrl-interfaces

    edit b1

    set vlan-id 301

    next

    edit b2

    set vlan-id 301

    end

    end