In a FortiAuthenticator active-active High Availability (HA) cluster, the primary goal is to synchronize configuration and user data to ensure consistent service. However, certain types of data are intentionally not synchronized to maintain node independence and reduce replication overhead.

The FortiAuthenticator Administration Guide explicitly states that real-time, high-volume data such as FSSO logon events are not synchronized. Each node maintains its own table of FSSO events.

While FortiToken data is synchronized, the term seeds can refer to system-level cryptographic seeds for functions like random number generation. These are unique to each appliance and are not synchronized as part of the HA process.

A. Group mappings: This is fundamental configuration data that defines user access and policies. It is always synchronized to ensure consistent behavior across the cluster.

B. User certificates: These are critical components of user identity data. The official documentation explicitly lists user certificates as data that is synchronized between HA members.

1. FortiAuthenticator 6.4 Administration Guide

Page 171

"High Availability" > "Synchronization".

This section provides a list of data that is not synchronized: "The following information is not synchronized between cluster members: FSSO logon events

RADIUS accounting data

Syslog data

Debug logs." This directly supports that FSSO events (C) are not synchronized.

The same section lists data that is synchronized

including: "Configuration"

"User data (local users

remote user sync data...)"

and "User certificates". This directly refutes option B and indirectly refutes A (as group mappings are part of the configuration).

2. FortiAuthenticator 6.2 Administration Guide

Page 160

"High Availability" > "Synchronization".

This guide contains the same lists

confirming that FSSO logon events (C) are not synchronized

while "User certificates" (B) and "FortiTokens" are synchronized. The synchronization of FortiTokens implies their essential data is replicated

but system-level seeds (D) for other cryptographic functions remain node-specific.