Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • FortiGate-7000 Handbook

    Home FortiGate-7000 6.0.9 FortiGate-7000 Handbook
    6.0.9
    6.2.3
    6.0.10
    6.0.9
    6.0.8
    6.0.6
    6.0.4
    5.6.14
    5.6.12
    5.6.11
    5.6.7
    5.4.9

    Introduction to FortiGate-7000 FGCP HA

    Introduction to FortiGate-7000 FGCP HA

    FortiGate-7000 supports active-passive FortiGate Clustering Protocol (FGCP) HA between two (and only two) identical FortiGate-7000s. You can configure FortiGate-7000 HA in much the same way as any FortiGate HA setup except that only active-passive HA is supported, and even though FortiGate-7000s are configured with VDOMS, virtual clustering is not supported.

    You must use the 10Gbit M1 and M2 interfaces for HA heartbeat communication. See Connect the M1 and M2 interfaces for HA heartbeat communication. Heartbeat packets are VLAN-tagged and you can configure the VLANs used. You must configure the switch interfaces used to connect the M1 and M2 interfaces in trunk mode and the switches must allow the VLAN-tagged packets.

    As part of the FortiGate-7000 HA configuration, you assign each of the FortiGate-7000s in the HA cluster a chassis ID of 1 or 2. The chassis IDs just allow you to identify individual FortiGate-7000s and do not influence primary unit selection.

    Note

    If both FortiGate-7000s in a cluster are configured with the same chassis ID, both chassis begin operating in HA mode without forming a cluster. A message similar to the following is displayed on the CLI console of both devices:

    HA cannot be formed because this box's chassis-id 1 is the same from the HA peer 'F76E9D3E17000001' chassis-id 1.

    As well, a log message similar to the following is created:

    Jan 29 16:29:46 10.160.45.70 date=2020-01-29 time=16:29:51 devname="CH-02" devid="F76E9D3E17000001" slot=1 logid="0108037904" type="event" subtype="ha" level="error" vd="mgmt-vdom" eventtime=1580344192162305962 tz="-0800" logdesc="Device set as HA master" msg="HA group detected chassis-id conflict" ha_group=7 sn="F76E9DT018900001 chassis-id=1"

    You can resolve this issue by logging into one of the FortiGates and changing its Chassis ID to 2. When this happens, the two chassis will form a cluster.
    Example FortiGate-7040 HA configuration

    In a FortiGate-7000 FGCP HA configuration, the primary (or master) FortiGate-7000 processes all traffic. The secondary FortiGate-7000 operates in hot standby mode. The FGCP synchronizes the configuration, active sessions, routing information, and so on to the secondary FortiGate-7000. If the primary FortiGate-7000 fails, traffic automatically fails over to the secondary.

    Previous
    Next

    Introduction to FortiGate-7000 FGCP HA

    Introduction to FortiGate-7000 FGCP HA

    FortiGate-7000 supports active-passive FortiGate Clustering Protocol (FGCP) HA between two (and only two) identical FortiGate-7000s. You can configure FortiGate-7000 HA in much the same way as any FortiGate HA setup except that only active-passive HA is supported, and even though FortiGate-7000s are configured with VDOMS, virtual clustering is not supported.

    You must use the 10Gbit M1 and M2 interfaces for HA heartbeat communication. See Connect the M1 and M2 interfaces for HA heartbeat communication. Heartbeat packets are VLAN-tagged and you can configure the VLANs used. You must configure the switch interfaces used to connect the M1 and M2 interfaces in trunk mode and the switches must allow the VLAN-tagged packets.

    As part of the FortiGate-7000 HA configuration, you assign each of the FortiGate-7000s in the HA cluster a chassis ID of 1 or 2. The chassis IDs just allow you to identify individual FortiGate-7000s and do not influence primary unit selection.

    Note

    If both FortiGate-7000s in a cluster are configured with the same chassis ID, both chassis begin operating in HA mode without forming a cluster. A message similar to the following is displayed on the CLI console of both devices:

    HA cannot be formed because this box's chassis-id 1 is the same from the HA peer 'F76E9D3E17000001' chassis-id 1.

    As well, a log message similar to the following is created:

    Jan 29 16:29:46 10.160.45.70 date=2020-01-29 time=16:29:51 devname="CH-02" devid="F76E9D3E17000001" slot=1 logid="0108037904" type="event" subtype="ha" level="error" vd="mgmt-vdom" eventtime=1580344192162305962 tz="-0800" logdesc="Device set as HA master" msg="HA group detected chassis-id conflict" ha_group=7 sn="F76E9DT018900001 chassis-id=1"

    You can resolve this issue by logging into one of the FortiGates and changing its Chassis ID to 2. When this happens, the two chassis will form a cluster.
    Example FortiGate-7040 HA configuration

    In a FortiGate-7000 FGCP HA configuration, the primary (or master) FortiGate-7000 processes all traffic. The secondary FortiGate-7000 operates in hot standby mode. The FGCP synchronizes the configuration, active sessions, routing information, and so on to the secondary FortiGate-7000. If the primary FortiGate-7000 fails, traffic automatically fails over to the secondary.

    Previous
    Next