Active-passive and active-active HA
The first decision to make when configuring FortiGate HA is whether to choose active‑passive or active-active HA mode. To configure the HA mode, go to System > HA and set Mode to Active-Passive or Active-Active.
From the CLI enter the following command to set the HA mode to active-passive:
config system ha
set mode a-p
end
To form a cluster, all cluster units must be set to the same mode. You can also change the mode after the cluster is up and running. Changing the mode of a functioning cluster causes a slight delay while the cluster renegotiates to operate in the new mode and possibly select a new primary unit.
Active-passive HA (failover protection)
An active-passive (A-P) HA cluster provides hot standby failover protection. An active‑passive cluster consists of a primary unit that processes communication sessions, and one or more subordinate units. The subordinate units are connected to the network and to the primary unit but do not process communication sessions. Instead, the subordinate units run in a standby state. In this standby state, the configuration of the subordinate units is synchronized with the configuration of the primary unit and the subordinate units monitor the status of the primary unit.
Active-passive HA provides transparent device failover among cluster units. If a cluster unit fails, another immediately take its place.
Active-passive HA also provides transparent link failover among cluster units. If a cluster unit interface fails or is disconnected, this cluster unit updates the link state database and the cluster negotiates and may select a new primary unit.
If session failover (also called session pickup) is enabled, active-passive HA provides session failover for some communication sessions.
The following example shows how to configure a FortiGate for active-passive HA operation. You would enter the exact same commands on every FortiGate in the cluster.
config system ha
set mode a-p
set group-name myname
set password HApass
end
Active-active HA (load balancing and failover protection)
By default, active-active HA load balancing distributes proxy-based security profile processing to all cluster units. Proxy-based security profile processing is CPU and memory-intensive, so FGCP load balancing may result in higher throughput because resource-intensive processing is distributed among all cluster units.
Normally, sessions accepted by policies that don’t include security profiles are not load balanced and are processed by the primary unit. You can configure active-active HA to load balance additional sessions.
An active‑active HA cluster consists of a primary unit that receives all communication sessions and load balances them among the primary unit and all of the subordinate units. In an active-active cluster the subordinate units are also considered active since they also process content processing sessions. In all other ways active-active HA operates the same as active-passive HA.
The following example shows how to configure a FortiGate for active-active HA operation. You would enter the exact same commands on every FortiGate in the cluster.
config system ha
set mode a-a
set group-name myname
set password HApass
end