Setting up FortiGate HA

To set up FortiGate HA:

1. Go to Compute Engine > VM Instances.
2. Note the external IP addresses assigned to nic0 on each FortiGate.
3. Connect to the primary FortiGate's external IP address using SSH, then enter the following commands:

   config system ha

   set group-name <choose a group name for the cluster>

   set mode a-p

   set hbdev "port3" 100

   set session-pickup enable

   set session-pickup-connectionless enable

   set ha-mgmt-status enable

   config ha-mgmt-interfaces

   edit 1

   set interface "port4"

   set gateway <ip address of MGMT network intrinsic router>

   next

   end

   set override disable

   set priority 255

   set unicast-hb enable

   set unicast-hb-peerip <ip address of HA interface of secondary FortiGate>

   set unicast-hb-netmask <netmask of HA sync network>

   end

   config system sdn-connector

   edit "gcp_conn"

   set type gcp

   set ha-status enable

   config external-ip

   edit "reserve-fgthapublic"

   next

   end

   config route

   edit "route-internal"

   next

   end

   set use-metadata-iam disable

   set gcp-project "..."

   set service-account "..."

   set private-key "..."

   next

   end

4. Connect to the secondary FortiGate's external IP address using SSH, then enter the following commands:

   config system ha

   set group-name <enter the same group name you entered in the primary FortiGate>

   set mode a-p

   set hbdev "port3" 100

   set session-pickup enable

   set session-pickup-connectionless enable

   set ha-mgmt-status enable

   config ha-mgmt-interfaces

   edit 1

   set interface "port4"

   set gateway <ip address of MGMT network intrinsic router>

   next

   end

   set override disable

   set priority 255

   set unicast-hb enable

   set unicast-hb-peerip <ip address of HA interface of primary FortiGate>

   set unicast-hb-netmask <netmask of HA sync network>

   end

5. In the GCP console, go to VPC network > Routes.
6. Note the name of the default route table created in Creating a GCP route table.
7. Go to Compute Engine > VM Instances.
8. Note the primary FortiGate's external IP address.