Technical Tip: VIP Configuration on the FortiGate VM Active-Passive HA Cluster

[mrashidi]

Description	This article describes how to configure Virtual IPs on the FortiGate VM Active-Passive HA Cluster to have no issues if failover happens.
Scope	FortiGate-VM, AWS-FortiGate, Azure-FortiGate, GCP-FortiGate, OCI-FortiGate, or any other FortiGate-VMs hosted on Public Cloud.
Solution	There are two different ways to implement VIPs on the FortiGate-VM HA cluster. Diagram: Create two different VIPs for each FortiGate on the Primary FortiGate, and put both of them in the Firewall policy as the destination: On Primary FortiGate: VIP1: FGT-A External IP:Port => Server IP:Port VIP2: FGT-B External IP:Port => Server IP:Port Example1: On the Primary FortiGate (FGT-A): VIPs. Firewall Policy. Add the VIP in the vdom-exception to prevent the VIPs from synching between the FortiGates, and then, create the VIPs separately on each FortiGate with the same name and put it in the Firewall policy as the destination: config system vdom-exception edit 1 set object firewall.vip next end On Primary FortiGate: VIP: FGT-A External IP:Port => Server IP:Port On Secondary FortiGate: VIP: FGT-B External IP:Port => Server IP:Port   Example2: On the Primary FortiGate (FGT-A): VIP. Firewall Policy. On the Secondary FortiGate (FGT-B): VIP. Related documents: Technical Tip: How to fix the failover issue when there is a FortiGate-VM HA cluster with multiple I.... VDOM exceptions | FortiGate / FortiOS 7.4.3 | Fortinet Document Library. Virtual IPs with port forwarding | FortiGate / FortiOS 7.4.3 | Fortinet Document Library.