Fortinet FortiGate FortiGate-5001FA2 Installation Manual page 13

Configuring the FortiGate for the Network
FortiGate-5000 series Installation Guide
Link If one of the links to a FortiGate unit in an HA cluster fails, all functions, all
established firewall connections, and all IPSec VPN sessions
redundancy
by the other FortiGate units in the HA cluster.
Device If one of the FortiGate units in an HA cluster fails, all functions, all established
firewall connections, and all IPSec VPN sessions are maintained by the other
redundancy
FortiGate units in the HA cluster.
a.HA does not provide session failover for PPPoE, DHCP, PPTP, and L2TP services.
Once the FortiGate-5000 modules are added to the HA cluster, the cluster functions
on your network as a single module with n interfaces where n is the number of
FortiGate-5000 modules multiplied by the available interfaces on the module. The
cluster manages communication and load balancing between the modules.
You can operate an HA cluster in NAT/Route or Transparent mode. For more
information on HA, see
Figure 3: HA network configuration in NAT/Route mode
FortiGate-5001SX HA cluster in in NAT/Route
Port2
204.23.1.5
Internet
Figure 4: HA network configuration in Transparent mode
Gateway to
public network
204.23.1.5 192.168.1.1
Internet
(firewall, router)
Port1
01-28011-0259-20060210
"High availability installation" on page
mode in a FortiGate-5020 chassis
USB
1 2
CONSOLE
PWR ACC
USB
1 2
CONSOLE
PWR ACC
NAT mode policies controlling
traffic between internal and
external networks.
FortiGate-5001SX HA Cluster in Transparent
mode in a FortiGate-5020 chassis
USB
CONSOLE 1 2 3 4 5 6
PWR ACC
USB
CONSOLE 1 2 3 4 5 6
PWR ACC
192.168.1.2
Management IP
Transparent mode policies
controlling traffic between
internal and external networks
32.
Internal network
Port1
192.168.1.99
PSU A
PSU B
3 4 5 6 7 8
STA IPM
3 4 5 6 7 8
STA IPM
Port 3
DMZ network
10.10.10.1
PSU A
PSU B
Internal network
7 8
STA IPM
7 8
Port2
STA IPM
a
are maintained
192.168.1.3
Route mode policies
controlling traffic between
internal networks.
10.10.10.2
192.168.1.3
13