Fortinet black logo

GCP Administration Guide

Setting up FortiGate HA

Copy Link
Copy Doc ID 62d32ecf-687f-11ea-9384-00505692583a:856600
Download PDF

Setting up FortiGate HA

To set up FortiGate HA:
  1. Go to Compute Engine > VM Instances.
  2. Note the external IP addresses assigned to nic0 on each FortiGate.
  3. Connect to the primary FortiGate's external IP address using SSH, then enter the following commands:

    config system ha

    set group-name <choose a group name for the cluster>

    set mode a-p

    set hbdev "port3" 100

    set session-pickup enable

    set session-pickup-connectionless enable

    set ha-mgmt-status enable

    config ha-mgmt-interfaces

    edit 1

    set interface "port4"

    set gateway <ip address of MGMT network intrinsic router>

    next

    end

    set override disable

    set priority 255

    set unicast-hb enable

    set unicast-hb-peerip <ip address of HA interface of secondary FortiGate>

    set unicast-hb-netmask <netmask of HA sync network>

    end

    config system sdn-connector

    edit "gcp_conn"

    set type gcp

    set ha-status enable

    config external-ip

    edit "reserve-fgthapublic"

    next

    end

    config route

    edit "route-internal"

    next

    end

    set use-metadata-iam disable

    set gcp-project "..."

    set service-account "..."

    set private-key "..."

    next

    end

  4. Connect to the secondary FortiGate's external IP address using SSH, then enter the following commands:

    config system ha

    set group-name <enter the same group name you entered in the primary FortiGate>

    set mode a-p

    set hbdev "port3" 100

    set session-pickup enable

    set session-pickup-connectionless enable

    set ha-mgmt-status enable

    config ha-mgmt-interfaces

    edit 1

    set interface "port4"

    set gateway <ip address of MGMT network intrinsic router>

    next

    end

    set override disable

    set priority 255

    set unicast-hb enable

    set unicast-hb-peerip <ip address of HA interface of primary FortiGate>

    set unicast-hb-netmask <netmask of HA sync network>

    end

  5. In the GCP console, go to VPC network > Routes.
  6. Note the name of the default route table created in Creating a GCP route table.
  7. Go to Compute Engine > VM Instances.
  8. Note the primary FortiGate's external IP address.

Setting up FortiGate HA

To set up FortiGate HA:
  1. Go to Compute Engine > VM Instances.
  2. Note the external IP addresses assigned to nic0 on each FortiGate.
  3. Connect to the primary FortiGate's external IP address using SSH, then enter the following commands:

    config system ha

    set group-name <choose a group name for the cluster>

    set mode a-p

    set hbdev "port3" 100

    set session-pickup enable

    set session-pickup-connectionless enable

    set ha-mgmt-status enable

    config ha-mgmt-interfaces

    edit 1

    set interface "port4"

    set gateway <ip address of MGMT network intrinsic router>

    next

    end

    set override disable

    set priority 255

    set unicast-hb enable

    set unicast-hb-peerip <ip address of HA interface of secondary FortiGate>

    set unicast-hb-netmask <netmask of HA sync network>

    end

    config system sdn-connector

    edit "gcp_conn"

    set type gcp

    set ha-status enable

    config external-ip

    edit "reserve-fgthapublic"

    next

    end

    config route

    edit "route-internal"

    next

    end

    set use-metadata-iam disable

    set gcp-project "..."

    set service-account "..."

    set private-key "..."

    next

    end

  4. Connect to the secondary FortiGate's external IP address using SSH, then enter the following commands:

    config system ha

    set group-name <enter the same group name you entered in the primary FortiGate>

    set mode a-p

    set hbdev "port3" 100

    set session-pickup enable

    set session-pickup-connectionless enable

    set ha-mgmt-status enable

    config ha-mgmt-interfaces

    edit 1

    set interface "port4"

    set gateway <ip address of MGMT network intrinsic router>

    next

    end

    set override disable

    set priority 255

    set unicast-hb enable

    set unicast-hb-peerip <ip address of HA interface of primary FortiGate>

    set unicast-hb-netmask <netmask of HA sync network>

    end

  5. In the GCP console, go to VPC network > Routes.
  6. Note the name of the default route table created in Creating a GCP route table.
  7. Go to Compute Engine > VM Instances.
  8. Note the primary FortiGate's external IP address.