https://bertsmets.be/tags/high-availability/ Recent content in High-Availability on Bert's IT & Security Notes Hugo en-us Tue, 10 Nov 2026 11:26:28 +0100 https://bertsmets.be/posts/fortigate_ha/ Tue, 10 Nov 2026 11:26:28 +0100 https://bertsmets.be/posts/fortigate_ha/ <h2 id="description">Description</h2> <p>A pair of Fortigate 401F devices had to be configured for High-Availability, in active-passive mode. Configuring two FortiGate 401F units in High Availability (HA) ensures that if one unit fails, the other takes over seamlessly. For the 401F, which features a dedicated NP7 processor, the setup is straightforward but requires strict adherence to hardware and licensing matching.</p> <h2 id="prerequisites">Prerequisites</h2> <p>Before touching the configuration, ensure both units meet these criteria:</p> <ul> <li>Identical Hardware: Both must be 401F models.Identical Firmware: Ensure both are running the exact same FortiOS version (e.g., v7.6.x).</li> <li>Licensing: Both units must have the same level of support and security subscriptions (FortiGuard, etc.) registered to the same Fortinet Support account.</li> <li>Physical Connections: <ul> <li>Heartbeat Links: Use at least two dedicated cables between the units for redundancy. On the 401F, use the dedicated HA and MGMT2 ports or any two 10GE SFP+ ports.</li> <li>Data Links: Connect the corresponding data ports (WAN, Internal) of both units to the same upstream/downstream switches.</li> </ul> </li> <li>Factory Reset: Not mandatory but it is highly recommended to factory reset the secondary unit to avoid configuration conflicts.</li> </ul> <h2 id="configuration">Configuration</h2> <p>We will be using multiple vdom&rsquo;s to separate managment traffic from production traffic, so we will first enable this in the firewall and then make sure the managment interface is part of the root vdom. Enabling multi-vdom mode should be done on both devices.</p>