Fortigate 400E HA structure

[BensonLEI]

Hi, Fortinet guys,

I am fully new to Fortinet products. Recently, my company purchased a pair of Fortigate 400E to set up HA structure.

May I know if the Fortigate 400E:

1. Active-active mode is good deployment for Fortigate 400E ?

1. Supports "FGCP HA with 802.3ad aggregated interfaces" ?

2. Which 2 interfaces are used/good to be deployed Heartbeat interfaces ?

Many thanks in advance.

[ede_pfau · Accepted solution]

hi,

and welcome to the forums.

Generally, I prefer a-p mode (active/passive) for stability. That does not mean that a-a mode is unreliable. In a-a mode, much more information has to be shared between cluster members, and the perceived increase in performance is not 100% but more like 40%. IMHO, if you need a-a clustering for performance your choice of hardware was inadequate in the beginning.

Second question: in general, all FGT models running the same FortiOS version support the same features. There are very few exceptions for desktop models, like not offering LACP. The 400E as a mid-range model does support HA and LACP and thus what you're asking for.

I never really bothered much about bandwidth of the HA links, and have never seen it saturated. The whole HA setup is straightforward, robust and 99% of the time set up and working. For best practice, always use more than one HA link, and I make sure I always use red cables...

Just to make it easy, first connect the cluster and then configure ports to be monitored. This makes the election process a bit quicker and more stable.

HA heartbeat (HA link) interfaces can be any interface the hardware supports, that is, "wan1" as well as "HA" as well as any SFP/SFP+ port. The FGT will create a subnet on that connection in the 169.254.x.x address range. Maybe sync traffic is even load balanced on 2 or more links.

Anyway, if you're going to employ HA you should have a good read on the HA chapter in the FortiOS Handbook. It's densely written but gives you the complete picture.

[emnoc · Accepted solution]

1: Active Active does not active lob all appications and services so keep that in mind you need to read about act-act and it's features 

https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-high-availability-52/HA_a-a.htm

2: In the past you could do a aggregated-ethernet as heart-beat in fortiOS but I haven't tried , just selected at least 2 interfaces for sync/hb for the 2x FGT400E

3: does not matter, just grab 2 interfaes 1gig and set them up for hb-sync example port1&2 cables together between unit 1 and unit 2

Ken Felix

[TecnetRuss · Accepted solution]

For your question about which ports to use for the HA heartbeat link between the two units, the FortiGate 400E has one dedicated/reserved "HA" Gigabit port right beside the "Console" and "MGMT" so you should use that for the first link.  For the second HA link you can use any "normal" ethernet or SFP port (1-28).  Don't use the MGMT port or the S1/S2/VW1/VW2 ports.

Russ

NSE7

[ede_pfau · Accepted solution]

hi,

and welcome to the forums.

Generally, I prefer a-p mode (active/passive) for stability. That does not mean that a-a mode is unreliable. In a-a mode, much more information has to be shared between cluster members, and the perceived increase in performance is not 100% but more like 40%. IMHO, if you need a-a clustering for performance your choice of hardware was inadequate in the beginning.

Second question: in general, all FGT models running the same FortiOS version support the same features. There are very few exceptions for desktop models, like not offering LACP. The 400E as a mid-range model does support HA and LACP and thus what you're asking for.

I never really bothered much about bandwidth of the HA links, and have never seen it saturated. The whole HA setup is straightforward, robust and 99% of the time set up and working. For best practice, always use more than one HA link, and I make sure I always use red cables...

Just to make it easy, first connect the cluster and then configure ports to be monitored. This makes the election process a bit quicker and more stable.

HA heartbeat (HA link) interfaces can be any interface the hardware supports, that is, "wan1" as well as "HA" as well as any SFP/SFP+ port. The FGT will create a subnet on that connection in the 169.254.x.x address range. Maybe sync traffic is even load balanced on 2 or more links.

Anyway, if you're going to employ HA you should have a good read on the HA chapter in the FortiOS Handbook. It's densely written but gives you the complete picture.

[BensonLEI]

Hi, ede_pfau,

Thanks so much for your precious information, May I know which model or higher is suitable for a-a mode structure, thx ?

Cheers

[ede_pfau · Accepted solution]

You can use any model from the 30E on upwards for a-a HA, theoretically. In practice, you will see this in midrange models, that is, 100E upwards.

Again, why would I use a-a over a-p? Both modes provide for redundancy, but a-a features load balancing. For instance, with a high number of SSLVPN clients and some other CPU intensive tasks at the same time. I wouldn't expect that when deploying low range models. Given that midrange models of the E or F series are really powerful, I don't see why I should use a-a mode here either.

YMMV, as always.

May I ask you for one favor: please do not rate posts with 1 or 2 stars; this actually reduces reputation. OK if you mean it, but I reckon the "-2...+2" rating scheme is not self-explanatory and your intention was the opposite.

So 1 star="b-s", 2 stars="plain wrong", 3 stars="why rate at all", 4 stars="helpful", 5 stars="cool!"

[BensonLEI]

Hi, ede_pfau,

Firstly, for the STAR marking, I am very sorry for all you experts; I could not be allowed to make more stars, for all your precious information ( might it be the forum rule, especially for new member ?).

Based on your recommendation, I may consider a-p mode, then ( a bit pity ).

Cheers.

[ede_pfau]

No problem at all. a-p mode is rock solid, as I tend to say, and you'll be happy having it. No reason to feel pity, it's not inferior at all.

[emnoc · Accepted solution]

1: Active Active does not active lob all appications and services so keep that in mind you need to read about act-act and it's features 

https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-high-availability-52/HA_a-a.htm

2: In the past you could do a aggregated-ethernet as heart-beat in fortiOS but I haven't tried , just selected at least 2 interfaces for sync/hb for the 2x FGT400E

3: does not matter, just grab 2 interfaes 1gig and set them up for hb-sync example port1&2 cables together between unit 1 and unit 2

Ken Felix

[TecnetRuss · Accepted solution]

For your question about which ports to use for the HA heartbeat link between the two units, the FortiGate 400E has one dedicated/reserved "HA" Gigabit port right beside the "Console" and "MGMT" so you should use that for the first link.  For the second HA link you can use any "normal" ethernet or SFP port (1-28).  Don't use the MGMT port or the S1/S2/VW1/VW2 ports.

Russ

NSE7

[BensonLEI]

Thanks so much for all your precise and precious recommendations.