Fortinet fortigate-200a Betriebsanweisung

Setting the heartbeat priority for more interfaces increases the reliability of the cluster. 
To optimize bandwidth use, you can route most heartbeat traffic to interfaces that 
handle less network traffic. You can also create a failover path by setting heartbeat 
priorities so that you can control the order in which interfaces are used for heartbeat 
traffic.

The heartbeat priority must be set for at least one cluster interface. If heartbeat 
communication is interrupted the cluster stops processing traffic.

You do not need to assign IP addresses to the heartbeat device interfaces for them to 
be able to process heartbeat packets. In HA mode the cluster assigns virtual IP 
addresses to the heartbeat device interfaces. The primary cluster unit heartbeat 
device interface is assigned the IP address 10.0.0.1 and the subordinate unit is 
assigned the IP address 10.0.0.2. A third cluster unit would be assigned the IP 
address 10.0.0.3 and so on.

For best results, isolate each heartbeat device on its own network. Heartbeat packets 
contain sensitive information about the cluster configuration. Also, heartbeat packets 
may use a considerable amount of network bandwidth and it is preferable to isolate 
this traffic from your user networks. The extra bandwidth used by heartbeat packets 
could also reduce the capacity of the interface to process network traffic.

For most FortiGate models if you do not change the heartbeat device configuration, 
you would isolate the HA interfaces of all of the cluster units by connecting them all to 
the same switch. If the cluster consists of two FortiGate units you can connect the 
heartbeat device interfaces directly using a crossover cable.

HA heartbeat and data traffic are supported on the same FortiGate interface. In 
NAT/Route mode, if you decide to use the heartbeat device interfaces for processing 
network traffic or for a management connection, you can assign the interface any IP 
address. This IP address does not affect the heartbeat traffic. In Transparent mode, 
you can connect the interface to your network.

Enable or disable monitoring a FortiGate interface to verify that the interface is 
functioning properly and connected to its network. If a monitored interface fails or is 
disconnected from its network the interface leaves the cluster. The cluster reroutes 
the traffic being processed by that interface to the same interface of another cluster 
unit in the cluster that still has a connection to the network. This other cluster unit 
becomes the new primary cluster unit.

If you can re-establish traffic flow through the interface (for example, if you re-connect 
a disconnected network cable) the interface rejoins the cluster. If Override Master is 
enabled for this FortiGate unit (see 

), this FortiGate unit 

becomes the primary unit in the cluster again.

Note: Only monitor interfaces that are connected to networks.