Description

A pair of Fortigate 401F devices had to be configured for High-Availability, in active-passive mode. Configuring two FortiGate 401F units in High Availability (HA) ensures that if one unit fails, the other takes over seamlessly. For the 401F, which features a dedicated NP7 processor, the setup is straightforward but requires strict adherence to hardware and licensing matching.

Prerequisites

Before touching the configuration, ensure both units meet these criteria:

  • Identical Hardware: Both must be 401F models.Identical Firmware: Ensure both are running the exact same FortiOS version (e.g., v7.6.x).
  • Licensing: Both units must have the same level of support and security subscriptions (FortiGuard, etc.) registered to the same Fortinet Support account.
  • Physical Connections:
    • Heartbeat Links: Use at least two dedicated cables between the units for redundancy. On the 401F, use the dedicated HA and MGMT2 ports or any two 10GE SFP+ ports.
    • Data Links: Connect the corresponding data ports (WAN, Internal) of both units to the same upstream/downstream switches.
  • Factory Reset: Not mandatory but it is highly recommended to factory reset the secondary unit to avoid configuration conflicts.

Configuration

We will be using multiple vdom’s to separate managment traffic from production traffic, so we will first enable this in the firewall and then make sure the managment interface is part of the root vdom. Enabling multi-vdom mode should be done on both devices.

config system global
    set vdom-mode multi-vdom
end

You will be logged out. Log back in, then:

config vdom
    edit second_vdom_name
    next
end
 
config global
config system global
    set hostname "FGT-A"
    set admintimeout 10
    set strong-crypto enable
    set admin-lockout-threshold 3
    set admin-lockout-duration 900
    set timezone "Europe/Brussels"
end
config system password-policy
    set status enable
    set apply-to admin-password
    set minimum-length <8-128>
    set min-lower-case-letter <0-128>
    set min-upper-case-letter <0-128>
    set min-number <0-128>
    set min-non-alphanumeric <0-128>
    set change-4-characters {enable | disable}
    set expire-status {enable | disable}
    set expire-day <1-999>
    set reuse-password {enable | disable}
end

The two units are identical apart from priority (200 on FGT-A, 100 on FGT-B) and mgmt IP. Configure and cable FGT-A first, then bring FGT-B up with the same HA block; the config syncs from the primary.

config system ha
    set group-id 10
    set group-name "FW-HA-GROUP"
    set mode a-p
    set password "HA_SECRET"
    set hbdev "ha" 200 "port16" 100
    set priority 200
    set override disable
    set encryption enable
    set authentication enable
    set session-pickup enable
    set session-pickup-connectionless enable
    set monitor "AGG-DATA"
    set ha-mgmt-status enable
    config ha-mgmt-interfaces
        edit 1
            set interface "mgmt"
            set gateway 10.10.10.1
        next
    end
end

In the example above, we are using the HA port and port16 for high-availability, and monitoring is done on an aggregate with name “AGG-DATA”. These should obviously be mofified to your own situation, together with the group-name, gateway-ip and secret. ha-mgmt-status gives each node its own OOB address, which stays reachable on the secondary too. The reserved mgmt interface must sit in the management VDOM (root). With override disable, the unit that has been up longest wins the election, so bring FGT-A up first.