1.5 High Availability (FGCP) Configuration & Election

High Availability (FGCP) Configuration & Election

Enterprise security architecture demands high availability and seamless hardware fault tolerance. The FortiGate Clustering Protocol (FGCP) is a proprietary clustering solution that groups two or more identical FortiGate appliances into a single logical High Availability (HA) cluster. FGCP guarantees sub-second failover, continuous stateful security inspection, and link failure recovery.

---

FGCP Operational Modes: Active-Passive vs. Active-Active

FGCP supports two primary cluster operational topologies:

1. Active-Passive (A-P) Mode

In an Active-Passive (A-P) cluster, one unit is elected as the Primary (Master) node, while all remaining units act as Secondary (Slave / Standby) nodes.

• Traffic Handling: The Primary unit processes 100% of data traffic, routing, NAT, and security profile content inspection.
• State Synchronization: The Primary unit continuously synchronizes firewall session state tables, IPsec VPN structures, DHCP leases, and routing tables to Secondary units across dedicated heartbeat links.
• Failover Behavior: If the Primary unit suffers a hardware, power, or link failure, a Secondary unit immediately assumes the Primary role with zero loss of active network sessions (when session-pickup is enabled).

2. Active-Active (A-A) Mode

In an Active-Active (A-A) cluster, all members actively process data traffic.

• Traffic Handling: The elected Primary unit continues to receive all incoming traffic, process Layer 3/4 routing, and manage NAT state tables. However, the Primary offloads resource-intensive Layer 7 Security Profile inspection (Antivirus, Web Filtering, IPS) for selected connections to Secondary units.
• Operational Caveat: Active-Active mode introduces processing overhead for connection distribution and does not increase overall Layer 3 packet routing capacity beyond that of a single node.

---

Virtual MAC (vMAC) Address Architecture

To ensure seamless network failover without requiring adjacent routers or switches to update their ARP tables, FGCP automatically assigns Virtual MAC (vMAC) addresses to all cluster interfaces.

vMAC Address Format

00-09-0f-09-xx-yy

• 00-09-0f: Fortinet Organizational Unique Identifier (OUI).
• 09: Standard FGCP vMAC identifier.
• xx: Cluster Group ID in hexadecimal (e.g., Group ID 10 = 0a).
• yy: Interface ID number in hexadecimal.

When a failover occurs, the secondary unit assuming the Primary role takes over ownership of the identical vMAC addresses. Surrounding network infrastructure continues transmitting frames to the same MAC destination, completely eliminating ARP cache convergence delays.

---

FGCP Primary Master Election Algorithm Hierarchy

When a cluster initializes or a topology change occurs, FGCP executes a strict sequential decision algorithm to select the Primary master node. The evaluation proceeds through four criteria in exact order:

[1. Monitored Interfaces] --> [2. HA Uptime (300s)] --> [3. HA Priority] --> [4. Serial Number]

Step-by-Step Election Decision Criteria

1. Monitored Interfaces: The FortiGate unit with the highest number of operational monitored interfaces wins the election. If an interface configured under set monitor experiences a link down event, the node loses points and fails over.
2. HA Uptime: If monitored interface counts are equal, FGCP compares continuous cluster uptime. A node whose uptime is at least 300 seconds (5 minutes) greater than competing nodes wins the election. (This 300-second buffer prevents flap failovers).
3. HA Priority: If uptime differences are within the 300-second window (or if override is enabled), the unit with the higher configured priority value (range: 1–255; default: 128) wins.
4. Serial Number: If priority values are identical, the unit with the alphabetically higher serial number wins as a final tie-breaker.

[!IMPORTANT] By default, the override setting is disabled (set override disable). When override is disabled, HA Uptime takes precedence over Priority. If a failed Primary node reboots and rejoins the cluster, it will NOT reclaim the Primary role even if it has a higher priority, preventing unnecessary traffic interruptions. If set override enable is configured, Priority overrides Uptime, forcing instant preemptive failback.

---

High Availability CLI Configuration & Session Pickup

Configuring FGCP requires matching group names, identical firmware builds, and assigned heartbeat interfaces on both units.

Primary Node CLI Setup

config system ha
    set group-id 10
    set group-name "HQ-HA-CLUSTER"
    set mode a-p
    set password EncryptedHAPassword123!
    set hbdev "port5" 50 "port6" 50
    set override disable
    set priority 200
    set monitor "port1" "port2"
    set session-pickup enable
    set session-pickup-delay disable
end

Critical HA Parameters Explained

• hbdev: Specifies dedicated physical heartbeat interfaces and their link priorities. At least two physical heartbeat links should be configured for redundancy to prevent split-brain conditions.
• monitor: Designates critical data interfaces (e.g., WAN and LAN). If a monitored link fails, FGCP triggers an automatic cluster failover.
• session-pickup: Enables real-time synchronization of non-sessionless TCP session tables across the heartbeat link. If disabled, active TCP connections drop during failover and clients must re-establish sessions.
• session-pickup-delay: When disabled, forces immediate synchronization of all sessions, including short-lived connections.

FGCP Primary Master Election Algorithm Decision Matrix