Fortinet Fortigate Cluster - Overview

The Fortinet Fortigate Cluster is a Fortinet-provided firewall virtual network function based on the Fortigate image. This blueprint supports the cluster deployment mode and defines a topology with two virtual devices.

The technology mainly used in this cluster architecture is FGSP (FortiGate Session Life Support Protocol). However, it is important to understand the difference between FGSP and the classical Fortinet HA technology, which is based on FGCP.

The classical Fortinet HA cluster technology is based on FGCP (FortiGate Clustering Protocol).

With FGCP, multiple FortiGates operate as a single logical firewall cluster using a Primary/Secondary architecture. The primary unit handles the traffic and owns the active sessions, while the secondary unit remains synchronized with the primary (configuration, routing information, session tables, policies, etc.). If the primary firewall fails, the secondary automatically takes over with minimal service interruption. This is the traditional Fortinet HA model used mainly for redundancy and high availability.

What is implemented here is FGSP (FortiGate Session Life Support Protocol), which is fundamentally different from a standard HA cluster.

FGSP does not create a single logical cluster and does not use a master/slave model. Each FortiGate remains fully independent with its own configuration, interfaces, routing, and management plane. There is no automatic full configuration synchronization as with FGCP.

The purpose of FGSP is mainly to synchronize session information between independent FortiGates. This allows multiple firewalls to process traffic simultaneously while sharing session states. In the event of a failure, another FortiGate can continue handling existing sessions because it already knows the session information exchanged through FGSP.

FGSP is particularly useful for traffic distribution and load-sharing architectures, especially in environments using asymmetric routing, ECMP, BGP, external load balancers, or multi-datacenter designs. Unlike FGCP, which focuses mainly on HA redundancy through a single cluster, FGSP provides much greater network flexibility and allows traffic flows to traverse different firewalls while maintaining session continuity.