FGCP

High availability (HA) is usually required in a system where there is high demand for little downtime. There are usually hot-swaps, backup routes, or standby backup units and as soon as the active entity fails, backup entities will start functioning. This results in minimal interruption for the users.

The FortiGate Clustering Protocol (FGCP) is a proprietary HA solution whereby FortiGates can find other member FortiGates to negotiate and create a cluster. A FortiGate HA cluster consists of at least two FortiGates (members) configured for HA operation. All FortiGates in the cluster must be the same model and have the same firmware installed. Cluster members must also have the same hardware configuration (such as the same number of hard disks). All cluster members share the same configurations except for their host name and priority in the HA settings. The cluster works like a device but always has a hot backup device.

Critical cluster components

The following are critical components in an HA cluster:

• Identical heartbeat connections and interfaces: members will use this to communicate with each other. In general, a two-member cluster is most common. We recommend double back-to-back heartbeat connections (as demonstrated in the topology).
• Identical connections for internal and external interfaces: we recommend similar connections from each member to the switches for the cluster to function properly (as demonstrated in the topology).

The HA heartbeat interface communicates with each unit in the cluster using the same heartbeat interface for each member. For example, if port1 and port2 are the heartbeat interfaces for the HA cluster, then in a cluster consisting of two members: port1 of the primary FortiGate should be connected to port1 of the secondary FortiGate. port2 of the primary FortiGate should be connected to port2 of the secondary FortiGate.

General operation

The following are best practices for general cluster operation:

• Ensure that heartbeat communication is present (see HA heartbeat interface).
• Enable the session synchronization option in daily operation (see FGSP basic peer setup).
• Monitor traffic flowing in and out of the interfaces.

Failover

FGCP provides failover protection in the following scenarios:

• The active device loses power.
• A monitored interface loses a connection.

After failover occurs, the user will not notice any difference, except that the active device has changed. See Failover protection for more information.

Synchronizing the configuration

FGCP uses a combination of incremental and periodic synchronization to make sure that the configuration of all cluster units is synchronized to that of the primary unit.

The following settings are not synchronized between cluster units:

• The FortiGate host name
• GUI Dashboard widgets
• HA override
• HA device priority
• The virtual cluster priority
• The HA priority setting for a ping server (or dead gateway detection) configuration
• The system interface settings of the HA reserved management interface
• The HA default route for the reserved management interface, set using the ha-mgmt-interface-gateway option of the config system ha command

Most subscriptions and licenses are not synchronized, as each FortiGate must be licensed individually. FortiToken Mobile is an exception; they are registered to the primary unit and synchronized to the secondary units.

The primary unit synchronizes all other configuration settings, including the other HA configuration settings.

All synchronization activity takes place over the HA heartbeat link using TCP/703 and UDP/703 packets.

The following topics provide more information about FGCP:

• Failover protection
• HA heartbeat interface
• Unicast HA heartbeat
• HA active-passive cluster setup
• HA active-active cluster setup
• HA and load balancing
• HA virtual cluster setup
• Check HA synchronization status
• Out-of-band management with reserved management interfaces
• In-band management
• Upgrading FortiGates in an HA cluster
• Distributed HA clusters
• HA between remote sites over managed FortiSwitches
• HA using a hardware switch to replace a physical switch
• VDOM exceptions
• Override FortiAnalyzer and syslog server settings
• Routing NetFlow data over the HA management interface
• Force HA failover for testing and demonstrations
• Disabling stateful SCTP inspection
• Resume IPS scanning of ICCP traffic after HA failover
• Querying autoscale clusters for FortiGate VM
• Cluster virtual MAC addresses
• Abbreviated TLS handshake after HA failover
• Session synchronization during HA failover for ZTNA proxy sessions
• Troubleshoot an HA formation