FortiGate HA Needs Two Licences
Byline: Megatron Technology Pte Ltd, Singapore. We size and supply Fortinet.
Related pages: Fortinet · FortiGate vs Meraki MX for Singapore offices · Knowledge base
A normal FortiGate high-availability (HA) pair needs two matching units and licences on both — FortiCare and FortiGuard (or the same bundle) on each serial. That is the opposite of Cisco Meraki MX warm spare, where one licence can cover two boxes. Budget for two appliances and two subscriptions unless your reseller confirms a Fortinet HA-specific SKU path that applies to your model.
Why FortiGate HA is licensed per unit
In Fortinet’s HA model, both appliances are full FortiGates that must stay capable of taking over. Fortinet’s technical guidance is that an HA cluster requires a set of licences for each unit. If one member’s contract is lower or expires earlier, the cluster effectively runs at the weaker entitlement. Identical model, matching firmware, and matching feature level are the baseline for a clean pair.
| Topic | FortiGate HA (typical) | Meraki MX warm spare |
|---|---|---|
| Hardware | Two identical FortiGate models | Two compatible MX appliances |
| Security / support licence | Normally one full set per serial | Often one MX licence covers primary + spare |
| Buyer takeaway | Quote should show two bundles (or an approved HA SKU deal) | See MX Warm Spare: One Licence for Two Boxes |
What should both units have?
Same model and hardware generation. Mixed generations are a common HA failure mode.
Same FortiOS version before you expect clean config sync.
Same FortiGuard / bundle level (for example both UTP, not UTP on one and ATP on the other).
FortiCare on both so hardware replacement and support cover whichever unit fails.
Same FortiCloud / support account registration.
Is there a single-licence HA option?
For some entry-level models, Fortinet documents a single FortiGuard licence for an active-passive HA pair when you buy the dedicated HA hardware SKUs (examples in Fortinet docs include FG-40F-HA style ordering) and register a virtual serial number (vSN). Supported model lists and FortiOS versions are published by Fortinet and change; à-la-carte subscriptions and active-active mode are outside that path. This is not the default for every FortiGate HA quote. Ask your reseller whether your exact models qualify, and confirm SKUs on the current Fortinet ordering information. Do not assume a Meraki-style “one licence for two boxes” deal on a standard dual-unit order.
When is HA worth the second box?
Buy HA when an hour of firewall downtime is a business problem: payment systems, clinic systems, trading screens, or a single internet edge for a packed office with dependence on cloud applications. If downtime is inconvenient but not critical, a single well-sized FortiGate plus solid FortiCare (and optionally Priority RMA) may be enough. Do not buy a second unlicensed unit “just in case” and call it HA — that spare will not take over cleanly under Fortinet’s licensing model.
Also plan renewals as a pair. Staggered expiry dates are a common operational trap: the cluster GUI tends to surface the earlier expiry, and one lapsed member weakens the whole design. Put both serials on the same term where you can, and ask your reseller for a renewal reminder that covers both.
Active-passive vs active-active (buyer view)
Most Singapore SME HA pairs are active-passive: one unit carries traffic; the other stands ready. Active-active exists for specific designs but brings different licensing and operational constraints — including for the special single FortiGuard HA SKU path, which Fortinet documents for active-passive only. Unless your integrator has a clear reason, budget and design for active-passive with matching licences.
What to ask for on the quote
Two hardware lines (or a clearly labelled HA SKU pair).
Bundle name and term on each serial — or one vSN bundle if using the documented HA licence path.
FortiCare level and any Priority RMA (for example 24×7×4) per unit or as applicable.
Registration to your company FortiCare account. Do not register to a specific user who may leave the company, locking you out of the portal.
Implementation: HA cabling, failover test, and who monitors renewals so both sides stay in sync.
Frequently asked questions
Can we licence only the primary and keep a cold spare unlicensed?
That is not a supported HA design. An unlicensed secondary will not give you the redundancy you think you bought. If budget is tight, discuss a single unit plus faster RMA versus a proper HA pair.
Do VMs need two licences too?
Yes — each FortiGate-VM instance in an HA pair needs its own entitlement. Platform must match (for example both on the same hypervisor type per Fortinet HA rules).
Does HA double our throughput?
No. Active-passive HA is for resilience. Size each unit for the full inspected traffic. See How to Size a FortiGate (Reading the Datasheet).
How is this different from Meraki?
Meraki’s warm-spare licensing model is intentionally different. If you are choosing platforms partly on HA licence cost, read both this note and the Meraki warm-spare guide, then compare total cost of two FortiGates versus MX primary + spare.
What if we already own one FortiGate?
You can add a second identical unit later, but confirm generation, RAM/flash variant and interface layout match HA rules for that platform. Buying “almost the same” model to save money often wastes the project. Your reseller should check serials and Fortinet’s current HA compatibility notes before you issue PO.
Does HA change how we size?
Size each member for peak inspected traffic with the features you will enable. HA is redundancy, not a licence to undersize. Pair this article with How to Size a FortiGate when refreshing.
Quote a FortiGate HA pair in Singapore
Megatron Technology Pte Ltd (est. 1990, UEN 199002644W) is a Singapore Cisco Networking Partner and Managed Services Provider, and a Fortinet reseller. We design, size, licence, procure, deploy and support Cisco Meraki, FortiGate, and Cisco Catalyst & Data Centre from 2 Kallang Avenue #08-17 CT Hub, Singapore 339407.