HA active-passive Cluster Setup

Cluster Setup

To set up an HA active-passive cluster:

  1. Go to the System → HA section.
  2. In the new window, select the Active-Passive mode from the drop-down menu in the Mode parameter.
  3. Fortigate is set to Standalone by default.
  4. Fill in the parameters.
  5. Device priority — 128 or higher. This parameter is responsible for the priority of the device, which will participate in the selection of the main device.
  6. Group name — the name of the group, in this case Test_cluster.
  7. Add interfaces that connect devices to Heartbeat interfaces by clicking + and selecting them on the right in the pop-up window.
  8. Except for the device priority, these settings must be the same on all FortiGates in the cluster.
  9. Click ОК.

The FortiGate negotiates to establish an HA cluster. Connectivity with the FortiGate may be temporarily lost as the HA cluster negotiates and the FGCP changes the MAC addresses of the FortiGate’s interfaces.

Repeat these steps on the other FortiGate devices.

As a result, a cluster of two FortiGate devices will be established. Devices will be reflected in the System → HA tab:

Checking the Cluster Health

Check the synchronization status of the cluster to ensure that the primary and auxiliary FortiGates have the same configuration.

On the main device, by running diagnose sys ha checksum cluster, you can display the checksums of device configurations:

#diagnose sys ha checksum cluster
 
================== FGVMEVZ0PVYJZL93 ==================
 
is_manage_master()=1, is_root_master()=1
debugzone
global: 25 84 34 90 3a 1a 3a d4 e3 ab 16 5d 97 b0 ea ee 
root: 03 06 19 93 30 e4 a5 9b 01 df 95 ba 49 57 17 8e 
all: cd 2c f6 18 02 eb d5 d7 14 1d ae f3 a6 ab 4c 13 
 
checksum
global: 25 84 34 90 3a 1a 3a d4 e3 ab 16 5d 97 b0 ea ee 
root: 03 06 19 93 30 e4 a5 9b 01 df 95 ba 49 57 17 8e 
all: cd 2c f6 18 02 eb d5 d7 14 1d ae f3 a6 ab 4c 13 
 
================== FGVMEV6UTHPHYC67 ==================
 
is_manage_master()=0, is_root_master()=0
debugzone
global: 25 84 34 90 3a 1a 3a d4 e3 ab 16 5d 97 b0 ea ee 
root: 03 06 19 93 30 e4 a5 9b 01 df 95 ba 49 57 17 8e 
all: cd 2c f6 18 02 eb d5 d7 14 1d ae f3 a6 ab 4c 13 
 
checksum
global: 25 84 34 90 3a 1a 3a d4 e3 ab 16 5d 97 b0 ea ee 
root: 03 06 19 93 30 e4 a5 9b 01 df 95 ba 49 57 17 8e 
all: cd 2c f6 18 02 eb d5 d7 14 1d ae f3 a6 ab 4c 13

If both cluster members have the same checksums, you can be sure that their configurations are synchronized. If the checksums are different, wait a bit and run the command again.

Repeat until the checksums are identical. Synchronization may take some time.

To view the status of a device in an HA cluster, run get system ha status:

#get system ha status
HA Health Status: OK
Model: FortiGate-VM64-KVM
Mode: HA A-P
Group: 0
Debug: 0
Cluster Uptime: 0 days 11:2:36
Cluster state change time: 2020-08-24 01:35:48
Master selected using:
       <2020/08/24 01:13:52> FGVMEVZ0PVYJZL93 is selected as the master because it has the largest value of uptime.
ses_pickup: disable
override: disable
Configuration Status:
    FGVMEVZ0PVYJZL93(updated 0 seconds ago): in-sync
    FGVMEV6UTHPHYC67(updated 3 seconds ago): in-sync
System Usage stats:
    FGVMEVZ0PVYJZL93(updated 0 seconds ago):
        sessions=41, average-cpu-user/nice/system/idle=0%/0%/0%/100%, memory=87%
    FGVMEV6UTHPHYC67(updated 3 seconds ago):
        sessions=0, average-cpu-user/nice/system/idle=0%/0%/0%/100%, memory=85%
HBDEV stats:
    FGVMEVZ0PVYJZL93(updated 0 seconds ago):
        port2: physical/10000full, up, rx-bytes/packets/dropped/errors=74075418/238255/0/0, tx=103380173/257440/0/0
        port3: physical/10000full, up, rx-bytes/packets/dropped/errors=65780382/186414/0/0, tx=70368890/198547/0/0
    FGVMEV6UTHPHYC67(updated 3 seconds ago):
        port2: physical/10000full, up, rx-bytes/packets/dropped/errors=4890715/15574/0/0, tx=3382554/12435/0/0
        port3: physical/10000full, up, rx-bytes/packets/dropped/errors=3434148/9899/0/0, tx=2391375/6815/0/0
Master: FG-1            , FGVMEVZ0PVYJZL93, HA cluster index = 0
Slave : FG-2            , FGVMEV6UTHPHYC67, HA cluster index = 1
number of vcluster: 1
vcluster 1: work 169.254.0.1
Master: FGVMEVZ0PVYJZL93, HA operating index = 0
Slave : FGVMEV6UTHPHYC67, HA operating index = 1