To connect the cluster to your network

1. Make the following physical network connections for FGT_ha_1:

• Port1 to Sw1 (active)
• Port2 to Sw2 (inactive)
• Port3 to Sw3 (active)
• Port4 to Sw4 (inactive)

2. Make the following physical network connections for FGT_ha_2:

• Port1 to Sw2 (active)
• Port2 to Sw1 (inactive)
• Port3 to Sw4 (active)
• Port4 to Sw3 (inactive)

3. Connect Sw3 and Sw4 to the internal network.

4. Connect Sw1 and Sw2 to the external router.

5. Enable 802.1Q (Dot1Q) or ISL communication between Sw1 and Sw2 and between Sw3 and Sw4.

6. Power on the cluster units.

The units start and negotiate to choose the primary unit and the subordinate unit. This negotiation occurs with no user intervention.

When negotiation is complete the cluster is ready to be configured for your network.

 

To view cluster status

Use the following steps to view the cluster dashboard and cluster members list to confirm that the cluster units are operating as a cluster.

1. View the system dashboard.

The System Information dashboard widget shows the Cluster Name (Rexample1.com) and the host names and serial numbers of the Cluster Members. The Unit Operation widget shows multiple cluster units.

2. Go to System > HA to view the cluster members list.

The list shows two cluster units, their host names, their roles in the cluster, and their priorities. You can use this list to confirm that the cluster is operating normally.

 

To troubleshoot the cluster configuration

If the cluster members list and the dashboard does not display information for both cluster units the FortiGate units are not functioning as a cluster. See Troubleshooting full mesh HA on page 1463 to troubleshoot the cluster.

 

To add basic configuration settings and the redundant interfaces

Use the following steps to add a few basic configuration settings.

1. Log into the cluster web-based manager.

2. Go to System > Admin > Administrators.

3. Edit admin and select Change Password.

4. Enter and confirm a new password.

5. Select OK.

6. Go to Router > Static > Static Routes and temporarily delete the default route.

You cannot add an interface to a redundant interface if any settings (such as the default route) are configured for it.

7. Go to System > Network > Interfaces and select Create New and configure the redundant interface to connect to the Internet.

Name                                           Port1_Port2

Type                                            Redundant

Physical Interface Members

Selected Interfaces                   port1, port2

IP/Netmask                                 172.20.120.141/24

8. Select OK.

9. Select Create New and configure the redundant interface to connect to the internal network.

Name                                           Port3_Port4

Type                                            Redundant

Physical Interface Members

Selected Interfaces                   port3, port4

IP/Netmask                                 10.11.101.100/24

Administrative Access             HTTPS, PING, SSH

10. Select OK.

The virtual MAC addresses of the FortiGate interfaces change to the following. Notice that port1 and port2 both have the port1 virtual MAC address and port3 and port4 both have the port3 virtual MAC address:

• port1 interface virtual MAC: 00-09-0f-09-00-00
• port10 interface virtual MAC: 00-09-0f-09-00-01 l  port11 interface virtual MAC: 00-09-0f-09-00-02 l  port12 interface virtual MAC: 00-09-0f-09-00-03 l  port13 interface virtual MAC: 00-09-0f-09-00-04 l  port14 interface virtual MAC: 00-09-0f-09-00-05 l  port15 interface virtual MAC: 00-09-0f-09-00-06 l  port16 interface virtual MAC: 00-09-0f-09-00-07 l  port17 interface virtual MAC: 00-09-0f-09-00-08 l  port18 interface virtual MAC: 00-09-0f-09-00-09 l  port19 interface virtual MAC: 00-09-0f-09-00-0a
• port2 interface virtual MAC: 00-09-0f-09-00-00 (same as port1)
• port20 interface virtual MAC: 00-09-0f-09-00-0c
• port3 interface virtual MAC: 00-09-0f-09-00-0d
• port4 interface virtual MAC: 00-09-0f-09-00-0d (same as port3)
• port5 interface virtual MAC: 00-09-0f-09-00-0f l  port6 interface virtual MAC: 00-09-0f-09-00-10 l  port7 interface virtual MAC: 00-09-0f-09-00-11 l  port8 interface virtual MAC: 00-09-0f-09-00-12 l  port9 interface virtual MAC: 00-09-0f-09-00-13

11. Go to Router > Static > Static Routes.

12. Add the default route.

Destination IP/Mask                 0.0.0.0/0.0.0.0

Gateway                                     172.20.120.2

Device                                         Port1_Port2

Distance                                     10

13. Select OK.