Configure Fortinet HA Pairs for Monitoring in Auvik

Overview

This article explains how to configure Fortinet FortiGate HA pairs for successful monitoring and management in Auvik.

While the HA deployment principles are covered in Best Practices for Deploying High Availability (HA) Firewall Pairs, Fortinet requires additional configuration to ensure both members of the HA pair are discovered and managed correctly.

Important

This article applies to Fortinet FortiGate HA deployments.

Always configure the HA cluster according to Fortinet's documentation before configuring Auvik. Auvik assumes the HA pair is already functioning correctly.

Before you begin

Verify that:

• The FortiGate HA cluster is operational.
• Failover has been tested successfully.
• Each firewall has a dedicated management interface.
• Each management interface has its own IP address.

Configure Out-of-Band management

Auvik recommends configuring dedicated OOB management interfaces on both FortiGate appliances.

If dedicated management interfaces are not configured, Auvik may consolidate both HA members into a single device after a failover event.

Configure manual IP mapping

After configuring the management interfaces, create the required manual IP mapping using Fortinet's documented procedure.

This ensures Auvik consistently associates management IP addresses with the correct physical appliance before and after HA failovers. (

Configure Auvik

Ensure Auvik can access both FortiGate appliances by:

• Scanning the production networks.
• Scanning the OOB management network.
• Configuring SNMP credentials.
• Configuring SSH credentials.
• Configuring API credentials (recommended).

Understanding HA Device Visibility

In a FortiGate HA deployment, each unit has its own serial number and may have its own management interface or IP address. Auvik may therefore display both HA members as separate devices.

Seeing two devices is expected when both members are reachable or reported through SNMP, LLDP, or FortiGate integrations. Monitoring both members provides visibility into the standby unit’s health and helps identify failover-related issues.

Configuration recommendations

• Enable and verify SNMP on both FortiGate units.
• If dedicated HA management interfaces are used, ensure SNMP is enabled and reachable on both interfaces.
• Enable LLDP or CDP on upstream switches where supported so each HA member reports distinct neighbor information.
• If the HA pair uses a shared management IP, confirm that the FortiGate HA SNMP information exposes the peer status correctly.
• If separate management IPs are used, scan the subnets containing those addresses and avoid overlapping discovery scopes.

Reduce confusion between HA members

Rename the devices in Auvik to include their HA role, such as:

• forti-ha-a-primary
• forti-ha-b-secondary

If you choose not to monitor the standby unit, set that device to Ignore, if available. Ignoring the device removes its monitoring and alert coverage. Confirm any billing impact according to your subscription terms.

If the HA pair is misidentified, provide Support with:

• SNMP walk results or screenshots showing HA status.
• Serial numbers for both units.
• Management IP addresses.
• The current and expected device roles.

Verify discovery

Confirm that:

• Both FortiGate appliances appear in Auvik inventory.
• Configuration backups complete successfully.
• Both devices remain visible after an HA failover.

Troubleshooting

If Auvik displays only one firewall after a failover:

• Verify both management interfaces are reachable.
• Verify the OOB network is included in Auvik discovery.
• Verify the Fortinet manual IP mapping has been configured correctly.
• Verify SNMP, SSH, and API access to both appliances.

Related documentation

• Best Practices for Deploying High Availability (HA) Firewall Pairs
• Fortinet HA configuration documentation
• Fortinet OOB management documentation