In a Microsoft Azure environment, virtual machines cannot use protocols like Gratuitous ARP

(GARP) to claim a shared IP address, which is a common mechanism for on-premises HA

failover. To create a functional active-active cluster that is reachable from an external network, an

Azure Load Balancer is a mandatory component. The public IP address must be assigned to the

frontend of the load balancer, which then uses health probes to distribute traffic across both active

FortiGate instances in the backend pool. This architecture is a fundamental requirement imposed

by the Azure cloud platform to achieve high availability and load balancing for inbound traffic.

B. You must use unicast FGCP to synchronize the configurations.

This is also a requirement for any FortiGate HA cluster in Azure (both active-active and

active-passive), not specifically just for active-active. Therefore, option A is more precise to the

active-active scenario.

C. You must configure both load balancers to allow administrative access.

This is incorrect. Exposing administrative interfaces through a public-facing load balancer is a

significant security vulnerability and is contrary to security best practices, not a requirement.

D. You must configure all FortiGate VMs with three or more interfaces.

While using a dedicated interface for HA synchronization (resulting in 3+ interfaces) is a

recommended best practice, it is not a strict technical requirement. The core function can be

configured with fewer interfaces.

1. Fortinet Documentation: FortiGate-VM on Azure Deployment Guide. In the section "Deploying

FortiGate-VM active-active HA cluster," the guide explicitly lists an "external Azure load balancer"

as a core component. It states, "The Azure load balancer is needed to probe and forward the

traffic to the healthy FortiGate-VMs." This confirms the load balancer's mandatory role.

URL: https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-administration-guide/9

33401/deploying-fortigate-vm-active-active-ha-cluster

2. Microsoft Azure Documentation: High availability for network virtual appliances. This document

describes the standard patterns for making Network Virtual Appliances (NVAs) like FortiGate

highly available in Azure, highlighting the central role of the Azure Load Balancer for both failover

and active-active load distribution.

URL: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/nva-ha

(See section: "NVA high availability with Azure Load Balancer").