Prerequisites for Automatic Configuration Sync in FortiGate HA Cluster
A network administrator has two FortiGate units that need to be configured as an HA cluster. Which TWO of the following are prerequisites for HA formation?
⚠ Common exam trap
Watch out — candidates often assume hostnames must match (Option B) because they confuse HA synchronization with general network device clustering, but FortiGate actually overwrites hostnames during sync, making mismatched hostnames irrelevant as a prerequisite.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both units must have the same FortiOS firmware version.
FortiGate HA clusters require all members to run the exact same FortiOS firmware version to ensure protocol compatibility and configuration synchronization. Mismatched firmware versions can cause cluster instability, failover failures, or split-brain scenarios, as the HA heartbeat protocol relies on consistent state machine behavior across units.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Both units must have the same FortiOS firmware version.
Why this is correct
Both units in a FortiGate HA cluster must run the exact same FortiOS firmware version and build. Mismatched versions can cause the HA protocol to behave unpredictably, leading to split-brain scenarios or failed failovers. Fortinet only supports HA when all cluster members share identical firmware, so this is a hard prerequisite before configuring HA.
- ✗
Both units must have the same hostname.
Why it's wrong here
The FortiGate hostname is a purely administrative label and is not used in HA negotiations or synchronization. HA members identify each other by serial number and HA group ID, not hostname, so two units can have different hostnames and the cluster will still function. In fact, FortiGate may even overwrite hostnames to match the primary, but that is a side effect, not a requirement.
- ✓
The HA heartbeat interface must be on the same Layer 2 network.
Why this is correct
The HA heartbeat interface must reside on the same Layer 2 broadcast domain on every cluster member. This allows the heartbeat packets (typically UDP port 703) to be exchanged continuously between units, providing liveness detection and session sync. If the heartbeat interfaces are on different subnets or separated by a router, HA negotiation will fail because the peer cannot be discovered.
- ✗
Both units must be in NAT/Route mode.
Why it's wrong here
Operating in NAT/Route mode is not a requirement for FortiGate HA. HA works in both NAT/Route and Transparent mode, provided all cluster members are configured in the same mode. A mixed-mode cluster is invalid, but NAT/Route mode alone is not mandatory—a transparent-mode cluster also supports HA failover and session synchronization.
- ✗
The HA priority must be set to 0 on both units.
Why it's wrong here
Setting HA priority to 0 on both units would not be a valid configuration; priority values range from 0 to 255, and the higher the priority, the more likely the unit becomes the primary. If both units have identical priority, the cluster falls back to comparing serial numbers, which is not a reliable way to configure preferred failover behavior. The correct practice is to set different priorities on each unit, not 0 on both.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.