1

I have 2xFG 600D for redundancy setup, where to use VRRP and HA configuration? which one is optimal for Nat mode ?

  • 1
    With HA the Fortigate needs to be the same model, as you already have. When using VRRP it allows you to use different hardware or even upgrade one Fortigate and still run redundant. Nat doesn't run faster or slower depending on your redundancy model. – user36472 Jul 4 '17 at 13:09
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 5:29
2

Additionally, FortiOS HA has several advantages over VRRP:

1- it is stateful, that is, the session, routing and NAT tables are kept synchronized on the slave unit. In case of HA failover, sessions are "picked up". This does of course not apply to IPsec VPN.
2- a failover can be triggered by a link failure (watching arbitrary hardware ports), a device failure or a link loss failure (using ping targets). The first 2 are detected within milliseconds.
3- the interruption of traffic is kept to a minimum, with some settings even "sub-second". VRRP takes a lot longer to detect and to fail over/converge. Even Layer 2 MAC addresses are virtualized so that the associated switches don't need to forget and relearn the slave's MAC address - which would only cost precious time.
4- if needed, the slave unit can be used for load sharing, mainly UTM scanning.
5- last but not least, the whole HA configuration and monitoring is accessible through the (cluster's) web interface on the master unit.

For this tight integration several prerequisites are necessary: - same version of FortiOS
- same hardware and device configuration (internal disk, RAM size, etc.)
- dedicated HA link(s)

Regarding the HA link, I've built HA clusters across a leased metro line over some miles. As long as bandwidth and latency are low you can build geographically dispersed clusters.
In short, if you've got the hardware FortiOS HA is way preferable over VRRP.

| improve this answer | |
1

Converting comment to answer.

With HA the Fortigate needs to be the same model, as you already have. When using VRRP it allows you to use different hardware or even upgrade one Fortigate and still run redundant. Nat doesn't run faster or slower depending on your redundancy model.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.