How are the configurations synchronized between two FortiGate VMs in an active-passive HA with SDN connector failover deployed from the Azure…

In an Azure environment, standard layer 2 broadcast and multicast traffic, which the FortiGate

Clustering Protocol (FGCP) typically uses for heartbeat and synchronization, is not supported. To

overcome this, FortiGate High Availability (HA) in Azure is configured to use unicast FGCP. The

HA cluster members send heartbeat and configuration synchronization packets directly to each

other's specified private IP addresses over a dedicated HA sync interface. This ensures that the

configuration of the passive unit remains synchronized with the active unit, allowing for a

seamless stateful failover.

B. Using system autoscaling during a failover: Autoscaling is an Azure feature for dynamically

adjusting the number of VM instances based on load, not for synchronizing configuration within an

HA pair.

C. An Azure function distributes the configuration files: The Azure Function in this architecture is

used to call the SDN connector to update Azure's routing tables during a failover event, not to

synchronize the FortiGate configuration files.

D. By configuring FGSP on the primary: FGSP (FortiGate Session Life Support Protocol) is used

for synchronizing sessions between separate, standalone FortiGates or clusters, not for

configuration synchronization within a single HA cluster.

1. Fortinet Document Library, FortiGate-VM on Azure 7.4.2, Deployment Guide: "High availability

for FortiGate-VM on Azure". This guide explicitly states, "In this active-passive HA deployment,

the FortiGate-VMs use unicast to find each other and form a cluster." It details the configuration

steps, including enabling unicast heartbeats.

URL: https://docs.fortinet.com/document/fortigate-vm-azure/7.4.2/azure-deployment-guide/13248

6/high-availability-for-fortigate-vm-on-azure

2. Fortinet Document Library, FortiOS 7.4.4, Administration Guide: "HA FGCP unicast". This

section describes the technical basis for using unicast for FGCP when multicast is unavailable,

which is the case in public cloud environments like Azure.

URL:

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/33204/ha-fgcp-unicast