Fortigate HA Configuration
Description A pair of Fortigate 401F devices had to be configured for High-Availability, in active-passive mode. Configuring two FortiGate 401F units in High Availability (HA) ensures that if one unit fails, the other takes over seamlessly. For the 401F, which features a dedicated NP7 processor, the setup is straightforward but requires strict adherence to hardware and licensing matching. Prerequisites Before touching the configuration, ensure both units meet these criteria: Identical Hardware: Both must be 401F models.Identical Firmware: Ensure both are running the exact same FortiOS version (e.g., v7.6.x). Licensing: Both units must have the same level of support and security subscriptions (FortiGuard, etc.) registered to the same Fortinet Support account. Physical Connections: Heartbeat Links: Use at least two dedicated cables between the units for redundancy. On the 401F, use the dedicated HA and MGMT2 ports or any two 10GE SFP+ ports. Data Links: Connect the corresponding data ports (WAN, Internal) of both units to the same upstream/downstream switches. Factory Reset: Not mandatory but it is highly recommended to factory reset the secondary unit to avoid configuration conflicts. Configuration We will be using multiple vdom’s to separate managment traffic from production traffic, so we will first enable this in the firewall and then make sure the managment interface is part of the root vdom. Enabling multi-vdom mode should be done on both devices. ...