Fortinet 98 FortiWeb 5.0 Patch 6 Administration Guide
Figure 17:HA topology and failover — IP address transfer to the new active appliance
The style of FortiWeb HA is active-passive: one appliance is elected to be the active appliance
(also called the primary, main, or master), applying the policies for all connections. The other is
a passive standby (also called the secondary, or slave), which assumes the role of the active
appliance and begins processing connections only if the active appliance fails.
The active and standby appliances detect failures by communicating through a heartbeat link
that connects the two appliances in the HA pair. Failure is assumed when the active appliance is
unresponsive to the heartbeat from the standby appliance for a configured amount of time:
Heartbeat timeout = Detection Interval x Heartbeat Lost Threshold
If the active appliance fails, a failover occurs: the standby becomes active. To do this, the
standby takes all IP addresses of the unresponsive appliance: it notifies the network via ARP to
redirect traffic for that virtual MAC address (vMAC) to its own network interfaces. (In transparent
modes, this includes the management IP. Additionally, at Layer 2, switches are notified that the
VMAC is now connected to a different physical port. So even though in these modes the
interfaces usually are transparent bridges without IPs, ARP traffic will still occur due to failover.)
Time required for traffic to be redirected to the new active appliance varies by your network’s
responsiveness to changeover notification and by your configuration:
Total failover time = ARP Packet Numbers x ARP Packet Interval + Network responsiveness
+ Heartbeat timeout
For best fault tolerance, make sure that your topology is fully redundant, with no single points of
failure.
For example, in Figure 17, the switch, firewall, and Internet connection are all single points of
failure. If any should fail, web sites would be unavailable, despite the HA cluster. To prevent this,
you would add a dual ISP connection to separate service providers, preferably with their own
redundant pathways upstream. You would also add a standby firewall, and a standby switch.