Introduction

FortiMail units can operate in either active-passive or active-active high availability (HA) mode. For details, see the FortiMail Administration Guide.

In Google Cloud Platform (GCP), you can use either a:

• FortiMail HA cluster only (no load balancer on GCP)

• network load balancer in front of the FortiMail VMs

to monitor the health of VMs, distribute traffic among HA members, and to avoid a FortiMail-VM that is on standby or that has become unresponsive. In this document, we show FortiMail HA cluster only.

In FortiMail HA, you can use either:

• active-active
• active-passive

In this document, we show active-passive HA. However active-active HA is deployed and configured similarly.

All FortiMail units that belong to an HA group require valid licenses. New VM instances may be deployed to auto-scale if there is more network load, or instances may be re-sized to meet billing changes. If that happens, verify again that all instances have valid licenses.

Prerequisites

Before you can configure a FortiMail HA cluster on GCP, you must have:

• A Google Cloud Platform account with an Identity and Access Management (IAM) user that has permission to create compute engine (VM) instances and configure networking

• A virtual private cloud (VPC) network

• VPC firewall rules that allow email traffic flow from the Internet to all FortiMail-VMs in the VPC network, and HTTPS traffic from your computer to access the administrative GUI

• Two FortiMail-VM instances deployed in the same VPC network subnet so that the HA heartbeat between them can occur over the internal network

For details, see the Google Cloud Platform Deployment Guide.

Deploy all components of the HA group in the same region and zone, and in the same VPC network. Health checks, HA heartbeats, and failover may not function correctly if the VMs are far apart, such as in different time zones or countries. Physical distance can cause HA communications to have too much latency. If you want to deploy in multiple regions to provide redundancy in case of a regional cloud outage, then deploy a separate FortiMail HA cluster in each region.