HA with redundant interfaces

You can combine two or more physical interfaces into a single redundant interface. Unlike aggregate interfaces (LACP), redundant interfaces do not increase throughput; instead, they provide a pure active-backup failover mechanism. Traffic is processed by a single port at a time, failing over to the next available member only if the active link goes down.

In an HA cluster, HA monitoring treats the redundant interface as a single logical entity. A cluster failover is triggered only if all physical ports within the redundant interface fail. The redundant interface uses a virtual MAC address derived from the first physical port added to its configuration.

In this example, two FortiGate units are configured in an HA cluster. Port 5 and Port 6 are used as heartbeat links. Redundant interfaces are used to connect to the internet (Port 1 and Port 2) and the internal network (Port 3 and Port 4). This ensures that if a cable or switch port fails on either unit, the redundant link takes over immediately without requiring a full cluster failover.

To configure the FortiGates for HA operation in the GUI:

1. On both FortiGates, go to System > HA and configure the following:

   Option	Value
   Mode	Active-Passive
   Group Name	Pochiya
   Password	***********
   Heartbeat interfaces	port5 port6
   Heartbeat Interface Priority	port5: 50 port6: 50

2. Click OK.

To configure the redundant interfaces in the GUI:

1. Go to Network > Static Routes and temporarily delete any routes using member ports (port1 to port4).

2. Go to Network > Interfaces and click Create new > Interface.

3. Configure the WAN redundant interface:

   Option	Value
   Name	WAN_Redundant
   Type	Redundant Interface
   Interface Members	port1 port2
   IP/Netmask	172.20.120.141/24

4. Click OK.

5. Click Create new > Interface again to create the internal redundant interface:

   Option	Value
   Name	Internal_Redundant
   Type	Redundant Interface
   Interface Members	port3 port4
   IP/Netmask	10.11.101.100/24

6. Click OK.

To configure static routing in the GUI:

1. Go to Network > Static Routes and click Create new.

2. Configure the following:

   Option	Value
   Destination	0.0.0.0/0.0.0.0
   Gateway Address	172.20.120.2
   Interface	WAN_Redundant

3. Click OK.

To configure HA port monitoring in the GUI:

1. Go to System > HA.

2. Edit the primary unit in the Cluster Members list.

3. Set Monitor Interfaces to WAN_Redundant and Internal_Redundant.

4. Click OK.

To configure HA with redundant interfaces in the CLI:

1. Configure HA on both units:

   config system ha
       set mode a-p
       set group-name Pochiya
       set password *********
       set hbdev port5 50 port6 50
   end
   

2. Create redundant interfaces:

   config system interface
       edit "WAN_Redundant"
           set type redundant
           set member port1 port2
           set ip 172.20.120.141 255.255.255.0
       next
       edit "Internal_Redundant"
           set type redundant
           set member port3 port4
           set ip 10.11.101.100 255.255.255.0
       next
   end
   

3. Configure static routing:

   config router static
       edit 1
           set gateway 172.20.120.2
           set device "WAN_Redundant"
       next
   end
   

4. Configure HA monitoring:

   config system ha
       set monitor "WAN_Redundant" "Internal_Redundant"
   end