Fortinet Document Library

Version:


Table of Contents

Cookbook

5.6.0
Download PDF
Copy Link

High availability with FGCP (expert)

This recipe describes how to enhance the reliability of a network protected by a FortiGate by adding a second FortiGate and setting up a FortiGate Clustering Protocol (FGCP) High availability (HA) cluster.

You will configure the FortiGate already on the network to become the primary FortiGate by:

  1. Licensing it (if required)
  2. Enabling HA
  3. Increasing its device priority
  4. Enabling override

You will prepare the new FortiGate by:

  1. Setting it to factory defaults to wipe any configuration changes
  2. Licensing it (if required)
  3. Enabling HA without changing the device priority and without enabling override
  4. Connecting it to the FortiGate already on the network

The new FortiGate becomes the backup FortiGate and its configuration is overwritten by the primary FortiGate.

This recipe describes best practices for configuring HA and involves extra steps that are not required for a basic HA setup. If you are looking for a basic HA recipe see High availability with two FortiGates.

Before you start, the FortiGates should be running the same FortiOS firmware version and their interfaces should not be configured to get addresses from DHCP or PPPoE.

Note

The FGCP does not support using a switch interface for the HA heartbeat. As an alternative to using the lan4 and lan5 interfaces as described in this recipe, you can use the wan1 and wan2 interfaces for the HA heartbeat.

High availability with FGCP (expert)

This recipe describes how to enhance the reliability of a network protected by a FortiGate by adding a second FortiGate and setting up a FortiGate Clustering Protocol (FGCP) High availability (HA) cluster.

You will configure the FortiGate already on the network to become the primary FortiGate by:

  1. Licensing it (if required)
  2. Enabling HA
  3. Increasing its device priority
  4. Enabling override

You will prepare the new FortiGate by:

  1. Setting it to factory defaults to wipe any configuration changes
  2. Licensing it (if required)
  3. Enabling HA without changing the device priority and without enabling override
  4. Connecting it to the FortiGate already on the network

The new FortiGate becomes the backup FortiGate and its configuration is overwritten by the primary FortiGate.

This recipe describes best practices for configuring HA and involves extra steps that are not required for a basic HA setup. If you are looking for a basic HA recipe see High availability with two FortiGates.

Before you start, the FortiGates should be running the same FortiOS firmware version and their interfaces should not be configured to get addresses from DHCP or PPPoE.

Note

The FGCP does not support using a switch interface for the HA heartbeat. As an alternative to using the lan4 and lan5 interfaces as described in this recipe, you can use the wan1 and wan2 interfaces for the HA heartbeat.