Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • FortiGate-6000 Handbook

    Home FortiGate-6000 6.4.13 FortiGate-6000 Handbook
    6.4.13
    7.0.16
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.10
    7.0.5
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.10
    6.4.8
    6.4.6
    6.4.2
    6.2.16
    6.2.16
    6.2.15
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.7
    6.2.6
    6.2.4
    6.2.3
    6.0.18
    6.0.17
    6.0.16
    6.0.15
    6.0.14
    6.0.13
    6.0.12
    6.0.10
    6.0.9
    6.0.8
    6.0.6
    6.0.4
    5.6.14
    5.6.12
    5.6.11
    5.6.7
    5.4.10

    Virtual clustering

    Virtual clustering

    FortiGate-6000 supports virtual clustering with two FortiGate-6000s operating in Multi VDOM mode. Virtual clustering is not supported for Split-Task VDOM mode.

    A virtual cluster consists of two FortiGate-6000s operating in active-passive HA mode with Multi VDOM mode enabled. Virtual clustering is an extension of FGCP HA that uses VDOM partitioning to send traffic for some VDOMs to the primary FortiGate-6000 and traffic for other VDOMs to the secondary FortiGate-6000. Distributing traffic between the FortiGate-6000s in a virtual cluster is similar to load balancing and can potentially improve overall throughput. You can adjust VDOM partitioning at any time to optimize traffic distribution without interrupting traffic flow.

    VDOM partitioning distributes VDOMs between two virtual clusters (virtual cluster 1 and virtual cluster 2). When configuring virtual clustering you would normally set the device priority of virtual cluster 1 higher for the primary FortiGate-6000 and the device priority of virtual cluster 2 higher for the secondary FortiGate-6000. With this configuration, all traffic in the VDOMs in virtual cluster 1 is processed by the primary FortiGate-6000 and all traffic in the VDOMs in virtual cluster 2 is processed by the secondary FortiGate-6000. The FGCP selects the primary and secondary FortiGate-6000 whenever the cluster negotiates. The primary FortiGate-6000 can dynamically change based on FGCP HA primary unit selection criteria.

    If a failure occurs and only one FortiGate-6000 continues to operate, all traffic fails over to that FortiGate-6000, similar to normal FGCP HA. When the failed FortiGate-6000rejoins the cluster, the configured traffic distribution is restored.

    For more information about virtual clustering see HA virtual cluster setup.

    Note

    If you don't want active-passive virtual clustering to distribute traffic between FortiGate-6000s, you can configure VDOM partitioning to send traffic for all VDOMs to the primary FortiGate-6000. The result is the same as standard active-passive FCGP HA, all traffic is processed by the primary FortiGate-6000.

    Virtual clustering creates a cluster between instances of each VDOM on the two FortiGate-6000s in the virtual cluster. All traffic to and from a given VDOM is sent to one of the FortiGate-6000s where it stays within its VDOM and is only processed by that VDOM. One FortiGate-6000 is the primary FortiGate-6000 for each VDOM and one FortiGate-6000 is the secondary FortiGate-6000 for each VDOM. The primary FortiGate-6000 processes all traffic for its VDOMs. The secondary FortiGate-6000 processes all traffic for its VDOMs.

    The HA heartbeat and session synchronization provides the same HA services in a virtual clustering configuration as in a standard HA configuration. One set of HA heartbeat interfaces provides HA heartbeat and session synchronization services for all of the VDOMs in the cluster. You do not have to add a heartbeat interface for each VDOM.

    Previous
    Next

    Virtual clustering

    Virtual clustering

    FortiGate-6000 supports virtual clustering with two FortiGate-6000s operating in Multi VDOM mode. Virtual clustering is not supported for Split-Task VDOM mode.

    A virtual cluster consists of two FortiGate-6000s operating in active-passive HA mode with Multi VDOM mode enabled. Virtual clustering is an extension of FGCP HA that uses VDOM partitioning to send traffic for some VDOMs to the primary FortiGate-6000 and traffic for other VDOMs to the secondary FortiGate-6000. Distributing traffic between the FortiGate-6000s in a virtual cluster is similar to load balancing and can potentially improve overall throughput. You can adjust VDOM partitioning at any time to optimize traffic distribution without interrupting traffic flow.

    VDOM partitioning distributes VDOMs between two virtual clusters (virtual cluster 1 and virtual cluster 2). When configuring virtual clustering you would normally set the device priority of virtual cluster 1 higher for the primary FortiGate-6000 and the device priority of virtual cluster 2 higher for the secondary FortiGate-6000. With this configuration, all traffic in the VDOMs in virtual cluster 1 is processed by the primary FortiGate-6000 and all traffic in the VDOMs in virtual cluster 2 is processed by the secondary FortiGate-6000. The FGCP selects the primary and secondary FortiGate-6000 whenever the cluster negotiates. The primary FortiGate-6000 can dynamically change based on FGCP HA primary unit selection criteria.

    If a failure occurs and only one FortiGate-6000 continues to operate, all traffic fails over to that FortiGate-6000, similar to normal FGCP HA. When the failed FortiGate-6000rejoins the cluster, the configured traffic distribution is restored.

    For more information about virtual clustering see HA virtual cluster setup.

    Note

    If you don't want active-passive virtual clustering to distribute traffic between FortiGate-6000s, you can configure VDOM partitioning to send traffic for all VDOMs to the primary FortiGate-6000. The result is the same as standard active-passive FCGP HA, all traffic is processed by the primary FortiGate-6000.

    Virtual clustering creates a cluster between instances of each VDOM on the two FortiGate-6000s in the virtual cluster. All traffic to and from a given VDOM is sent to one of the FortiGate-6000s where it stays within its VDOM and is only processed by that VDOM. One FortiGate-6000 is the primary FortiGate-6000 for each VDOM and one FortiGate-6000 is the secondary FortiGate-6000 for each VDOM. The primary FortiGate-6000 processes all traffic for its VDOMs. The secondary FortiGate-6000 processes all traffic for its VDOMs.

    The HA heartbeat and session synchronization provides the same HA services in a virtual clustering configuration as in a standard HA configuration. One set of HA heartbeat interfaces provides HA heartbeat and session synchronization services for all of the VDOMs in the cluster. You do not have to add a heartbeat interface for each VDOM.

    Previous
    Next