Configuring a NAT/Route mode active-passive cluster of two FortiGate units – web-based man- ager

Use the following procedures to configure two FortiGate units for NAT/Route HA operation using the web-based manager. These procedures assume you are starting with two FortiGate units with factory default settings.

Give each cluster unit a unique host name to make the individual units easier to identify when they are part of a functioning cluster. The default host name is the FortiGate serial number. You may want to change this host name to something more meaningful for your network.

 

To configure the first FortiGate unit (host name FGT_ha_1)

1. Register and apply licenses to the FortiGate unit. This includes FortiCloud activation, FortiClient licensing, and

FortiToken licensing, and entering a license key if you purchased more than 10 Virtual Domains (VDOMS).

2. You can also install any third-party certificates on the primary FortiGate before forming the cluster. Once the cluster is formed third-party certificates are synchronized to the backup FortiGate.

3. On the System Information dashboard widget beside Host Name, select Change.

4. Enter a new Host Name for this FortiGate unit.

 

New Name                                  FGT_ha_1

5. Select OK.

6. Go to System > HA and change the following settings:

Mode                                           Active-Passive

Group Name                              example1.com

Password                                   HA_pass_1

This is the minimum recommended configuration for an active-passive HA cluster. You can also configure other HA options, but if you wait until after the cluster is operating you will only have to configure these options once for the cluster instead of separately for each unit in the cluster.

7. Select OK.

The FortiGate unit negotiates to establish an HA cluster. When you select OK you may temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and the FGCP changes the MAC address of the FortiGate unit interfaces. The MAC addresses of the FortiGate interfaces change to the following virtual MAC addresses:

• port1 interface virtual MAC: 00-09-0f-09-00-00 l  port2 interface virtual MAC: 00-09-0f-09-00-01 l  port3 interface virtual MAC: 00-09-0f-09-00-02 l  port4 interface virtual MAC: 00-09-0f-09-00-03

To reconnect sooner, you can update the ARP table of your management PC by deleting the ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able to delete the arp table of your management PC from a command prompt using a command similar to arp -d.

To confirm these MAC address changes, you can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI command to view the virtual MAC address of any FortiGate unit interface. For example, use the following command to view the port1 interface virtual MAC address (MAC) and the port1 permanent MAC address (Permanent_HWaddr):

get hardware nic port1

Current_HWaddr: 00:09:0f:09:00:00

Permanent_HWaddr 02:09:0f:78:18:c9

10. Power off the first FortiGate unit (FGT_ha_1).

Note the details and format of the output of the get hardware nic command are specific to the interface hardware. Different FortiGate models and even different inter- faces in the same FortiGate unit may have different output.