FortiGate lab 21 of 25
High availability: FGCP active-passive
Turn two FortiGates into an active-passive FGCP cluster: find why a colleague's half-built secondary won't join, form the cluster, check synchronisation, fail over on a monitored interface while traffic flows, and control which unit is primary with priority and override.
Run this lab
It needs Lite: its 5 nodes are set to 5 vCPU and 7,680 MB in total. That fits the free demo too.
In your workspace: Shared, then FortiGate NSE 4 guided labs, then 21 - High availability - FGCP active-passive
- Level
- Advanced
- Time
- About 75 minutes
- Nodes need
- 5 vCPU, 7,680 MB
- Smallest plan
- Lite
The scenario
Harbourside's head office can't afford another outage like the one when FGT-A's power supply failed. A second FortiGate, FGT-B, has been racked and cabled exactly like FGT-A, with a direct heartbeat cable between the two port4s. A colleague started configuring HA on FGT-B before going on leave, and it hasn't joined anything. Build the cluster, find out what is wrong with FGT-B, and prove that users barely notice a failover.
| Device | Interface | Address | Connects to |
|---|---|---|---|
| FGT-A / FGT-B | port1 (ISP-A) | 203.0.113.1/24 (cluster) | INET, gateway 203.0.113.254 |
| FGT-A / FGT-B | port2 (LAN) | 10.1.10.1/24 (cluster) | PC1 10.1.10.10, H1 by DHCP |
| FGT-A / FGT-B | port4 | heartbeat (no address) | the other unit's port4 |
Cluster values: group name HQ-CLUSTER, group ID 10, password HaLabKey1!, heartbeat port4 (priority 50), monitored interfaces port1 and port2; FGT-A priority 200, FGT-B priority 100.
What you’ll practise
- Explain FGCP modes, heartbeat, configuration and session synchronisation, and virtual MACs
- Configure an active-passive cluster and diagnose settings that stop a member joining
- Check cluster health and synchronisation, and manage the secondary from the primary
- Fail over with interface monitoring and keep sessions with session pickup
- Predict the primary with and without override, and plan a cluster firmware upgrade
The tasks
- Start the lab
- How FGCP works
- Configure HA on FGT-A
- Why won't FGT-B join?
- Synchronisation and managing the secondary
- Fail over while traffic flows
- Override and upgrades
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- FGT-A
port1to ISP-A (network) - FGT-B
port1to ISP-A (network) - INET
eth0to ISP-A (network) - FGT-A
port2to LAN (network) - FGT-B
port2to LAN (network) - PC1
eth0to LAN (network) - H1
eth0to LAN (network) - FGT-A
port4to FGT-Bport4
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| FGT-A | Fortinet FortiGate | fortinet-FGT-v7.0.17.M-build0682 | 1 vCPU, 2,048 MB |
| FGT-B | Fortinet FortiGate | fortinet-FGT-v7.0.17.M-build0682 | 1 vCPU, 2,048 MB |
| INET | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 1,024 MB |
| PC1 | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 2,048 MB |
| H1 | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
FortiGate NSE 4 guided labs.Open
21 - High availability - FGCP active-passiveand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More FortiGate labs
Related labs in other courses
CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.