Configuring HA settings
Before you begin:
- You must have Read-Write permission to items in the System category.
- Before you configure HA Settings, familiarize yourself on how FortiDDoS High Availability works, here.
To configure HA settings:
- Go to System > High Availability.
- Complete the configuration as described in the table below.
- Save the configuration.
After you have saved the configuration, cluster members begin to send heartbeat traffic to each other. Members with the same Group ID join the cluster. They send synchronization traffic directly through the HA connection.
NOTE: If you change the HA Mode from Active-Passive to Standalone, HA settings will be reset to Default. Before you change to Standalone, take a screenshot or otherwise record the Active-Passive settings so you can restore them when you return to Active-Passive Mode.
High availability page
High availability settings
| Settings | Guidelines |
|---|---|
| Configured HA Mode |
This setting should only be changed after other non-synchronized settings are complete, although this is not mandatory. See HA synchronization for settings that are not synchronized between devices. When changed to active-passive, all synchronized parameters on the Secondary device will be replaced with data from the primary device and made read-only. Non-synchronized parameters may be modified on the Secondary device, as required, while it is in Active-Passive mode. |
| Port | Select the Mgmt port so use for HA monitoring and synching. If you are using a direct-connect cable, use Mgmt2 on both appliances to keep Mgmt1 free for system management. For Unicast and Multicast HA, you can use Mgmt1 for everything but using Mgmt2 offers some diversity. |
|
HA Loss Bypass Mode |
Note: this option will not appear on VMs since they have no Fail-Open Mode.
|
|
HA Protocol |
Multicast – use for direct-connect cable for collocated FortiDDoS appliances/VMs. This CAN be used for HA to remote datacenters, but all intermediate data switched must support L2 Multicast on the VLAN used (IGMP snooping must be disabled). Unicast – Preferred method for communication between geographically separated data centers. This requires a unicast IP address on each Mgmt2 port of each appliance/VM and Layer 3 connectivity between datacenters. |
|
Peer Address |
If Unicast is used from above, the IP address of Mgmt2 on the partner HA device. Note, if this is configured and the device you are configuring does not already have an IP address for its Mgmt2 port, you will be warned. |
| Group Name | Name to identify the HA pair. This setting is optional, and does not affect HA function. The maximum length is 35 characters (special characters . _ - @ ! * allowed). |
| Device Priority | Number indicating priority of the member node when electing the cluster primary node. The smaller the number, the higher the priority. It is mandatory to set this correctly. The valid range is 0 to 9 and the default is 5. |
| Group ID |
Number that identifies the HA cluster.
|
| Detection Interval | Number of 100-millisecond intervals at which heartbeat packets are sent. This is also the interval at which a node expects to receive heartbeat packets. These numbers must match on Primary and Secondary.
The valid range is 1 to 20 (that is, between 100 and 2,000 milliseconds). The default is 2 (200ms). |
| Heartbeat Lost Threshold | The number of times a node waits to receive HA heartbeat packets from the other node before concluding the other node is down. The valid range is from 1 to 60. The default is 6. Thus, default time is 200ms x 6 tries = 1.2 seconds. |
|
CLI commands:
set hbdev <mgmt1 | mgmt2> set ha-loss-bypass-mode < deployment | fail-open> set hb-type < multicast | unicast > set group-name <group_name_str> set group-id <0-63> Group ID must match on each appliance. set priority <0-9> 0 Priority is higher. set hb-interval <Detection Interval 1-20> In 100ms increments.
|