FortinetConfig623 downloads

Fortinet FortiGate HA Cluster

FortiGate FGCP (FortiGate Clustering Protocol) HA configuration for Active/Passive or Active/Active mode with session synchronization, heartbeat interfaces, and failover settings.

↓ example.txt

What is it?

FortiGate HA uses FGCP (FortiGate Clustering Protocol) to synchronize two or more FortiGates into an active/passive or active/active cluster. In active/passive mode, the primary handles all traffic; the secondary monitors via heartbeat and takes over if the primary fails. Session sync (session-pickup) keeps TCP sessions alive across failover. The heartbeat interfaces carry cluster management traffic — dedicate at least two physical interfaces for heartbeat redundancy. The unit with the highest priority becomes primary; in case of a tie, the unit with the highest serial number wins.

When to use

·Any production internet edge — a single FortiGate is a single point of failure
·Environments requiring zero-downtime FortiOS firmware upgrades (FGSP or HA upgrade path)
·Compliance requirements (PCI-DSS, HIPAA) mandating redundant security controls
·Data centers where session continuity across failover is required

When NOT to use

·Lab environments — HA adds complexity and requires matching hardware
·Active/Active mode unless you specifically need the extra throughput — it adds asymmetric routing complexity

How it compares

vs Palo Alto HABoth use dedicated control (HA1) and data sync (HA2) links. FortiGate uses FGCP protocol; Palo Alto uses its own HA protocol. FortiGate HA group-name and password must match on both units. PAN-OS HA is simpler to configure.

vs Cisco ASA FailoverASA uses a single 'failover' link for both control and state sync. FortiGate uses separate heartbeat (control) and session-sync interfaces. ASA requires 'failover key'; FortiGate uses 'password' in the HA config.

Prerequisites

→Both units must be identical hardware models running the same FortiOS version
→Dedicated heartbeat interfaces connected back-to-back between the two units (not through a switch)
→All data interfaces must be cabled identically on both units before enabling HA
→The secondary unit should have only basic initial config before joining the cluster — it will receive full config from primary

Config Generator

Hostname *

HA Mode

HA Group ID

HA Group Name *

HA Password *

Device Priority (higher=primary)

Primary: 200, Secondary: 100. Range 0-255.

Override mode (return to primary)?

Heartbeat Interfaces

Session synchronization?

Session sync interface

Monitored Interfaces (failover trigger)

Unicast heartbeat?

Peer heartbeat IP

Verification commands

get system ha status

Show HA cluster status, member roles, and sync state

ExpectedShows 'Master' and 'Slave' with config sync status. 'in-sync' means config is synchronized.

diagnose sys ha status

Show detailed HA status including heartbeat link state

ExpectedShows heartbeat interfaces, peer connectivity, and failover statistics

diagnose sys ha showcsum

Show configuration checksum to verify sync

ExpectedBoth units should show identical checksum. Different checksums = config out of sync.

Debug commands

diagnose debug application hatalk -1

Enable HA heartbeat debug logging

WarningUse briefly in production — generates heavy output. Disable after: 'diagnose debug application hatalk 0'

Common mistakes & fixes

SymptomBoth units become primary (split-brain)

CauseHeartbeat interfaces lost connectivity — each unit thinks the other failed

FixRestore heartbeat cable or fix network between heartbeat interfaces. The unit with lower priority will demote itself back to secondary once heartbeat resumes.

SymptomConfig out of sync — 'checksums differ'

CauseConfig change made on secondary while it was disconnected, or sync failed

FixForce sync from primary: 'execute ha synchronize start'. If fails, reset secondary to factory and let it rejoin the cluster.

SymptomSessions not surviving failover (clients reconnect)

CauseSession sync not enabled (session-pickup disable) or session-sync-dev not configured

FixEnable session-pickup: 'config system ha > set session-pickup enable'. Verify session-sync-dev points to a high-bandwidth interface between units.

Further learning

Recommended books to go deeper on this topic.

Palo Alto Networks Firewall Deployment and Administration

Tom Piens · Packt · PAN-OS HA — active/passive, active/active, session sync, preemption

Kindle ↗Hardcover ↗Paperback ↗

Cisco ASA: All-in-One Next-Gen Firewall, IPS, and VPN Services

Jazib Frahim, Omar Santos, Andrew Ossipov · Cisco Press · HA fundamentals — stateful failover concepts apply across vendors

Kindle ↗Hardcover ↗