FGCP

High availability (HA) is usually required in a system where there is high demand for little downtime. There are usually hot-swaps, backup routes, or standby backup units and as soon as the active entity fails, backup entities will start functioning. This results in minimal interruption for the users.

The FortiGate Clustering Protocol (FGCP) is a proprietary HA solution whereby FortiGates can find other member FortiGates to negotiate and create a cluster. A FortiGate HA cluster consists of at least two FortiGates (members) configured for HA operation. All FortiGates in the cluster must be the same model and have the same firmware installed. Cluster members must also have the same hardware configuration (such as the same number of hard disks). All cluster members share the same configurations except for their host name and priority in the HA settings. The cluster works like a device but always has a hot backup device.

Critical cluster components

The following are critical components in an HA cluster:

• Heartbeat connections: members will use this to communicate with each other. In general, a two-member cluster is most common. We recommend double back-to-back heartbeat connections.
• Identical connections for internal and external interfaces: as demonstrated in the topology, we recommend similar connections from each member to the switches for the cluster to function properly.

General operation

The following are best practices for general cluster operation:

• Ensure that heartbeat communication is present.
• Enable the session synchronization option in daily operation (see FGSP basic peer setup).
• Monitor traffic flowing in and out of the interfaces.

Failover

FGCP provides failover protection in the following scenarios:

• The active device loses power.
• A monitored interface loses a connection.

After failover occurs, the user will not notice any difference, except that the active device has changed. See Failover protection for more information.

Synchronizing the configuration

FGCP uses a combination of incremental and periodic synchronization to make sure that the configuration of all cluster units is synchronized to that of the primary unit.

The following settings are not synchronized between cluster units:

• The FortiGate host name
• GUI Dashboard widgets
• HA override
• HA device priority
• The virtual cluster priority
• The HA priority setting for a ping server (or dead gateway detection) configuration
• The system interface settings of the HA reserved management interface
• The HA default route for the reserved management interface, set using the ha-mgmt-interface-gateway option of the config system ha command

Most subscriptions and licenses are not synchronized, as each FortiGate must be licensed individually. FortiToken Mobile is an exception; they are registered to the primary unit and synchronized to the secondary units.

The primary unit synchronizes all other configuration settings, including the other HA configuration settings.

All synchronization activity takes place over the HA heartbeat link using TCP/703 and UDP/703 packets.

The following topics provide more information about FGCP:

• Failover protection
• HA active-passive cluster setup
• HA active-active cluster setup
• HA virtual cluster setup
• Check HA synchronization status
• Out-of-band management with reserved management interfaces
• In-band management
• Upgrading FortiGates in an HA cluster
• HA between remote sites over managed FortiSwitches
• HA using a hardware switch to replace a physical switch
• VDOM exceptions
• Override FortiAnalyzer and syslog server settings
• Routing NetFlow data over the HA management interface
• Force HA failover for testing and demonstrations
• Disabling stateful SCTP inspection
• Resume IPS scanning of ICCP traffic after HA failover
• Querying autoscale clusters for FortiGate VM
• Cluster virtual MAC addresses
• Troubleshoot an HA formation