Clusters of three or four FortiGate units
The FGCP supports a cluster of two, three, or four FortiGate units. You can add more than two units to a cluster to improve reliability: if two cluster units fail the third will continue to operate and so on. A cluster of three or four units in active-active mode may improve performance since another cluster unit is available for security profile processing. However, active-active FGCP HA results in diminishing performance returns as you add units to the cluster, so the additional performance achieved by adding the third cluster unit may not be worth the cost.
There are no special requirements for clusters of more than two units. Here are a few recommendations though:
- The matching heartbeat interfaces of all of the cluster units must be able to communicate with each other. So each unit’s matching heartbeat interface should be connected to the same switch. If the ha1 interface is used for heartbeat communication, then the ha1 interfaces of all of the units in the cluster must be connected together so communication can happen between all of the cluster units over the ha1 interface.
- Redundant heartbeat interfaces are recommended. You can reduce the number of points of failure by connecting each matching set of heartbeat interfaces to a different switch. This is not a requirement; however, and you can connect both heartbeat interfaces of all cluster units to the same switch. However, if that switch fails the cluster will stop forwarding traffic.
- For any cluster, a dedicated switch for each heartbeat interface is recommended because of the large volume of heartbeat traffic and to keep heartbeat traffic off of other networks, but it is not required.
- Full mesh HA can scale to three or four FortiGate units. Full mesh HA is not required if you have more than 2 units in a cluster.
- Virtual clustering can only be done with two FortiGates.
Connecting a cluster of three FortiGate units
This example shows how to connect a cluster of three FortiGate units where:
- Port1 connects the cluster to the Internet
- Port2 connects the cluster to the internal network
- Port3 and Port4 are the heartbeat interfaces
Use the following steps to connect the cluster units to each other and to their networks:
Connect the network interfaces:
- Connect the port1 interface of each FortiGate unit to the same switch (Switch 1) and connect this switch to the Internet.
- Connect the port2 interface of each FortiGate unit to the same switch (Switch 2) and connect this switch to the internal Network.
Connecting the network interfaces (cluster of three FortiGate units)
2. Connect the heartbeat interfaces:
- Connect the port3 interface of each FortiGate unit to the same switch (Switch 3)
- Connect the port4 interface of each FortiGate unit to the same switch (Switch 4)
Connecting the heartbeat interfaces (cluster of three FortiGate units)
The network and heartbeat connections when combined into one diagram appear like the following:
Network and heartbeat interface connections (cluster of three FortiGate units)