So, you went into to the interface and are looking for VRRP, but cant find it. I had done this 1000 times in other firmwares/devices and had no issues setting up VRRP. But for some reason on I could not find VRRP under the interface – Thought it was firmware/licensing (IP Services) – Nope all good there. The trick was that you have to enable the First Hop Routing Protocol you want to run.
Do this with
fhrp version vrrp v3 or v2
Now VRRP will show up under the interface and you can configure it as normal.
Some search help – Where is VRRP , 3850 VRRP not there
Fortigate supports many HA options. They have a great active/passive HA option, as well as Active/Active. VRRP is another option that is supported. VRRP (Virtual Routing Redundancy Protocol) is a open standards protocol that helps eliminates the single point of failure for a network by allowing another device to take over routing automatically.
Basically one router is the Master (active), the other is a Backup (passive), the selection of which device is active or passive is based priorities of each device, highest priority (1-255) is the most preferable. The priority of 100 is default, and 255 the best. There is a heartbeat which is just a Multicast packet, that goes across a link that both devices use (normal lan link is fine). If for some reason that heartbeat is lost , then the backup router will take over as the master.
VRRP is a great way to make sure that if one router fails the passive router will become active and take over routing for the network. VRRP creates a virtual mac address that is shared between the two devices, the active device answers for the virtual mac and takes control of the Virtual IP that is also shared between the two.
You can use VRRP to load balance traffic as well. Load balancing is achieved by using to different VRRP groups, and balancing which router is primary for what group. The below image should help clarify what I mean.
You can use those two VRRP groups as primary and secondary’s for the default gateway in different vlans. So in this case, you could have Vlan 10’s default gateway on Fortigate A, and Vlan 20’s on Fortigate B, therefore having fail-over for both, but splitting up the load. This might be a great thing to do if you have a HA cluster of 60C’s, and they just cant handle the full traffic load in a HA scenario. Remember. each config is different on these firewalls, there is no config sync. There is an option to sync sessions between the firewalls, so that if one firewall were to fail, things would pick right back up and not have to establish the sessions again.
Things to note in this config – There is already an IP address assigned to the Vlan interface for management when when the VRRP address might not be active. I am also using the Preempt option to make sure Active is always Active if its online. The Physical interface the Vlans are configured on are trunks on both links going to Fort-A, and Fort-B.
The config for VRRP is interface based, and CLI only.
config system interface
config vrrp edit 10 set vrip 10.10.10.1 set priority 255 set status enable set preempt enable end set vrrp-virtual-mac enable next
edit Vlan-20 config vrrp edit 20 set vrip 10.10.20.1 set priority 100 set status enable end set vrrp-virtual-mac enable end
config system interface
config vrrp edit 10 set vrip 10.10.10.1 set priority 100 set status enable end set vrrp-virtual-mac enable next
edit Vlan-20 config vrrp edit 20 set vrip 10.10.20.1 set priority 255 set status enable set preempt enable end set vrrp-virtual-mac enable end
This config will do exactly what we want, create a Virtual IP that is shared, and make sure the configured active (priority) unit takes back over the role of active if it goes offline and comes back online (preempt),