HA II

FortiGates keep their heartbeat virtual IP addresses regardless of any change in their role (primary or secondary).:
- The IP address assignment changes only when a FortiGate leaves or joins cluster.

As a best practice, in the moment a cluster is up and running and all interfaces are connected is recommended enabling interface monitoring. A monitored interface can easily become disconnected during initial setup and cause failovers to occur before the cluster is fully configured and tested.

Incremental synchronization:

After the initial synchronization is complete, the primary will send any further configuration changes done by an administrator to all the secondaries. For example, if you create a firewall address object, the primary doesn't resend its complete configuration, it sends just the new object.

When a new FortiGate is added to the cluster, the primary FortiGate compares its configuration checksum with the new secondary FortiGate configuration checksum. If the checksums don't match, the primary FortiGate uploads its complete configuration to the secondary FortiGate.

Not all the configuration settings are synchronized. There are a few that are not, such as:

- The system interface settings of the HA reserved management interface and the HA default route for the reserved management interface
- In-band HA management interface
- HA override
- HA device priority
- The virtual cluster priority
- The FortiGate host name
- The HA priority setting for a ping server (or dead gateway detection) configuration
- Licenses
- Caches

Session synchronization:
The synchronization of SSL VPN sessions is supported.

You can configure virtual clustering between with two or more FortiGate´s devices with multiple VDOMs.