FortiGate HA Configuration: Active-Passive Guide

 FortiGate High Availability (HA): A Simple Guide to Active-Passive Configuration

What happens if your firewall suddenly stops working? Your network may lose its internet connection and access to important services.

FortiGate High Availability (HA) helps reduce this risk by connecting two FortiGate firewalls to work as one system.

In this guide, you will learn what HA is, how Active-Passive works, and how to configure and test it using simple examples.

1. What Is FortiGate High Availability (HA)?

High Availability (HA) is a feature that helps keep network services running if a firewall fails.

An HA setup uses two FortiGate devices:

• Primary Firewall: Handles network traffic during normal operation.
• Secondary Firewall: Stays ready to take over if the primary firewall fails.

Both devices communicate with each other to monitor their status and synchronize configuration information.

The goal is to reduce downtime and keep the network available.

2. How Does Active-Passive HA Work?

In Active-Passive mode, one firewall actively handles traffic while the other waits as a backup.

For example:

1. The primary firewall handles internet traffic.
2. The secondary firewall monitors the HA cluster and remains ready.
3. If the primary firewall fails, the secondary can become the active firewall.
4. Network traffic resumes through the new active firewall, although some connections may need to reconnect.

This process is called failover.

Important: Failover may cause a brief interruption. The exact behavior depends on the failure, configuration, and network design.

3. Example Network Topology

Imagine a company using two FortiGate firewalls.

• FortiGate 1 is the primary firewall.
• FortiGate 2 is the secondary firewall.
• Both connect to the same network infrastructure.
• A dedicated heartbeat connection allows the devices to communicate.

The heartbeat connection helps the firewalls monitor each other and coordinate their HA roles.

4. Requirements Before Configuration

Before configuring HA, check the following:

• Two compatible FortiGate devices that support the required HA configuration.
• Compatible FortiOS versions and matching hardware requirements.
• Suitable interfaces for heartbeat communication.
• Matching HA settings, including the cluster name and password.
• A suitable network design for the connected interfaces.

Warning: HA configuration changes can interrupt network services. Perform the setup in a lab or maintenance window, and back up your configuration first.

5. Basic Active-Passive HA Configuration

The following example shows the main CLI settings used to configure an Active-Passive cluster.

Example only: The interface names, cluster name, and password must be adapted to your environment. Do not paste these commands into a production firewall without checking your configuration and the documentation for your FortiOS version.

Step 1: Configure the Primary Firewall

On the first FortiGate, enter the following commands:

config system ha
    set group-name "Company-HA"
    set mode a-p
    set password YOUR-STRONG-HA-PASSWORD
    set hbdev "port3" 50
    set session-pickup enable
end

What do these commands mean?

• group-name: Gives the HA cluster a name.
• mode a-p: Selects Active-Passive mode.
• password: Sets the password used for HA cluster authentication.
• hbdev: Selects the heartbeat interface. In this example, it is port3.
• session-pickup enable: Enables session synchronization for supported sessions.

Replace port3 with an appropriate heartbeat interface on your device. Confirm the supported settings for your FortiOS version before using the example.

Step 2: Configure the Secondary Firewall

Configure the second FortiGate with the same HA group name, mode, password, and compatible heartbeat settings.

For example:

config system ha
    set group-name "Company-HA"
    set mode a-p
    set password YOUR-STRONG-HA-PASSWORD
    set hbdev "port3" 50
    set session-pickup enable
end

Both devices must have compatible HA settings and be connected correctly. Once the devices discover each other, they can form a cluster if all requirements are met.

Important: HA setup can synchronize configuration between devices. Prepare the secondary device carefully and follow the official procedure for your FortiOS version to avoid overwriting or losing configuration.

6. How to Check HA Status

After configuring HA, verify that the devices have formed a cluster.

Run this command:

get system ha status

This command displays information about the HA cluster, including device roles and synchronization status.

You can also run:

diagnose sys ha status

Use the output to check whether both devices are detected and whether the cluster is operating as expected.

The exact output can vary by FortiOS version.

7. How to Test Failover

After confirming that the cluster is healthy, plan a controlled failover test.

1. Confirm that both firewalls are healthy and synchronized.
2. Record the current primary and secondary roles.
3. Follow the approved maintenance procedure to simulate a failure or initiate a supported failover test.
4. Check whether the secondary becomes active.
5. Test internet access and important network services.
6. Verify the cluster status again.

Do not disconnect cables or power off a production firewall without authorization and a recovery plan.

A successful test confirms that the backup device can take over under the tested conditions. It does not guarantee that every existing connection will remain uninterrupted.

8. Common HA Problems

Problem 1: The Firewalls Do Not Form a Cluster

Possible causes include:

• Incorrect HA group name or password.
• Heartbeat interfaces are not connected correctly.
• Incompatible device models or software versions.
• Different or unsupported HA settings.

Check the configuration and physical heartbeat connection on both devices.

Problem 2: Configuration Is Not Synchronized

Check the cluster status and confirm which device is authoritative.

Review synchronization warnings and follow the Fortinet troubleshooting guidance for your software version. Avoid making unrelated configuration changes on both devices.

Problem 3: Failover Does Not Work as Expected

Possible causes include incorrect monitored-interface settings, a failure that is not detected as expected, or a network connectivity issue after failover.

Review HA status, monitored interfaces, and the surrounding network design before repeating the test.

Conclusion

FortiGate High Availability helps reduce downtime by allowing a secondary firewall to take over when the primary firewall fails.

The key concepts are simple:

• Primary: Handles network traffic.
• Secondary: Stays ready to take over.
• Heartbeat: Allows the firewalls to monitor and coordinate with each other.
• Failover: Transfers the active role to the secondary device when required.

Understanding these concepts is the first step toward building a more resilient network.

Before configuring HA in a real environment, check the official Fortinet documentation for your FortiGate model and FortiOS version.