I have 2xFG 600D for redundancy setup, where to use VRRP and HA configuration? which one is optimal for Nat mode ?
Additionally, FortiOS HA has several advantages over VRRP:
1- it is stateful, that is, the session, routing and NAT tables are kept synchronized on the slave unit. In case of HA failover, sessions are "picked up". This does of course not apply to IPsec VPN.
2- a failover can be triggered by a link failure (watching arbitrary hardware ports), a device failure or a link loss failure (using ping targets). The first 2 are detected within milliseconds.
3- the interruption of traffic is kept to a minimum, with some settings even "sub-second". VRRP takes a lot longer to detect and to fail over/converge. Even Layer 2 MAC addresses are virtualized so that the associated switches don't need to forget and relearn the slave's MAC address - which would only cost precious time.
4- if needed, the slave unit can be used for load sharing, mainly UTM scanning.
5- last but not least, the whole HA configuration and monitoring is accessible through the (cluster's) web interface on the master unit.
For this tight integration several prerequisites are necessary:
- same version of FortiOS
- same hardware and device configuration (internal disk, RAM size, etc.)
- dedicated HA link(s)
Regarding the HA link, I've built HA clusters across a leased metro line over some miles. As long as bandwidth and latency are low you can build geographically dispersed clusters.
In short, if you've got the hardware FortiOS HA is way preferable over VRRP.