FortiManager supports FortiGate auto-scale clusters

FortiManager supports the public cloud functionality to scale-in or scale-out the number of FortiGate-VMs on-demand using auto-scaling. When an auto-scale event is triggered, the public cloud platform will launch a new FortiGate-VM and it will appear automatically on FortiManager as an authorized device in the Device Manager. When a scale-in event occurs, the device will automatically removed from FortiManager.

FortiManager cannot be used to manage the upgrade of Virtual Machine Scale Set (VMSS) FortiGates in Azure.

Example of how FortiManager manages auto-scale clusters

As an example, an administrator creates an auto-scale cluster on the public cloud with two FortiGate-VMs which includes a rule to trigger a scale-out event when the CPU or network utilization exceeds 70% capacity. The scale-out event increases the number of FortiGate-VMs in the cluster to three so that the additional traffic can be managed.

In the event of a scale-out, the newly added FortiGate device syncs with the Primary FortiGate in the cluster and fetches the FortiManager configuration. Once the deployment and sync is complete on the new FortiGate, the device is authorized and added to the existing cluster on the FortiManager.

A separate rule specifies that when the CPU or network utilization is less than 10%, a scale-in event occurs to reduce the number of FortiGate-VMs back to two. When the scale-in event occurs, the third FortiGate device is automatically removed from FortiManager.

These changes are reflected on the FortiManager without any manual intervention required.

The amount of time required for FortiManager to add or remove FortiGate devices to or from the cluster depends upon the time it takes to deploy or terminate the FortiGate-VM on the cloud, and for the FortiGate clusters to resync.

To manage FortiGate auto-scale clusters on FortiManager:

1. Add the auto-scale cluster to FortiManager:
   • Add the FortiGate auto-scale cluster to FortiManager for the first time using the IP address of the Primary FortiGate. Once the configuration between the cluster members are in sync, the remaining devices are added to the FortiManager automatically.
   • Alternatively, you can configure the FortiManager Fabric Connector on the Primary FortiGate to add the cluster to FortiManager.
   • You can check the Serial Number, Hostname, HA Status and elastic IP of the FortiGate cluster devices in the Device Manager.
     
   • Administrators can check the HA mode (i.e. auto-scale) along with cluster members, roles, and the elastic IP in the device database.
     
2. When a scale-out event occurs where the number of FortiGate devices in the cluster increases, once the newly added FortiGate becomes a part of the cluster and syncs its configuration with the cluster's Primary device, it is added to FortiManager.
   On FortiManager, the device is automatically authorized and added to the existing cluster without manual intervention.
   
3. When a scale-in event occurs where the number of FortiGate devices in the cluster decreases, once the FortiGate is removed from the cluster on the cloud and the FGFM expires on the FortiManager, the FortiGate device will be removed from the cluster on FortiManager.
   
4. During any scale-in event, if the Primary FortiGate is removed from the cluster on the cloud, then FortiManager will be able to detect the change and will reflect the state of the new Primary and Secondary devices in the Device Manager.
   In the example image below the Primary FortiGate failed and there was an auto-scale event to replace it. The new Primary FortiGate is displayed on FortiManager.