Configure HTTP load balancing for servers behind a FortiGate firewall

Last update: October 05 2026Open in Markdown

For your information

This guide provides an example of how to configure HTTP traffic load balancing between servers behind a firewall.

For your information

This instruction is relevant for FortiOS versions 6.x and 7.x. If you have a different version of FortiOS, you can find instructions in the official FortiGate documentation.

1. If you have not yet linked FortiGate to servers, connect the FortiGate firewall to servers in the Selectel infrastructure.
2. Create a health check.
3. Create a virtual server.
4. Create a security policy.
5. Check load balancing operation.

1. Connect the FortiGate firewall to the servers in the Selectel infrastructure

Use the Connect products and services via global router instructions.

2. Create a health check

Health Check determines the operability of a server behind the firewall based on configured parameters. If a server behind the firewall stops responding, FortiGate will redirect requests to available servers.

Graphical interface

1. Connect to the firewall.
2. Make sure that under System → Feature Visibility, the Load Balance toggle is enabled. If the toggle is disabled, the sections with load balancing settings will not be displayed.
3. Go to Policy & Objects → Health Check.
4. Click Create New.
5. In the Name field, enter the name of the health check.
6. In the Type field, select the health check protocol HTTP.
7. In the Interval field, enter the check frequency for the server behind the firewall in seconds or leave the default value.
8. In the Timeout field, enter the maximum response timeout from the server behind the firewall in seconds or leave the default value.
9. In the Retry field, enter the number of failed health checks after which the server behind the firewall will be excluded from load balancing, or leave the default value.
10. In the Port field, enter the port to check the availability of the server behind the firewall. By default, it is port 80.
11. In the URL field, enter the path to the file on the server behind the firewall to which FortiGate will send a GET request to check the server's availability. For example, /health.html.
12. In the Matched content field, enter the text that FortiGate will look for in the GET request response body. For example, OK.
13. Click OK.

CLI

1. Connect to the firewall.

2. Create a health check:

   config firewall ldb-monitor
       edit <health_check_name>
           set type http
           set port <health_check_port>
           set http-get "<url>"
           set http-match "<text>"
           set interval <interval>
           set timeout <timeout>
           set retry <retry>
       next
   end

   Specify:

   • <health_check_name> — health check name;
   • <health_check_port> — port for checking the availability of the server behind the firewall. By default, it is port 80;
   • <url> — path to the file on the server behind the firewall to which FortiGate will send a GET request to check the server's availability. For example, /health.html;
   • <text> — text that FortiGate will search for in the GET request response body. For example, OK;
   • <interval> — check frequency for the server behind the firewall in seconds;
   • <timeout> — maximum response timeout from the server behind the firewall in seconds;
   • <retry> — number of failed health checks after which the server behind the firewall will be excluded from load balancing.

3. Create a virtual server

A Virtual Server accepts incoming traffic and redirects it to real servers (Real Server) — the IP address and port of the server behind the firewall. You can add multiple real servers so that FortiGate automatically distributes the load between them.

Graphical interface

1. Connect to the firewall.

2. Go to Policy & Objects → Virtual Servers.

3. Click Create New.

4. In the Name field, enter the name of the virtual server.

5. In the Type field, select the HTTP protocol.

6. In the Interface field, select through which firewall interface requests will arrive at the virtual server:

   • to receive requests only through one interface, select this interface. For example, wan1;
   • to receive requests through all interfaces, select any.

7. In the Virtual Server IP field, enter the public IP address of the firewall that you received in the ticket after ordering the firewall.

8. In the Virtual Server Port field, enter the port on the firewall that incoming requests will arrive at.

9. In the Load Balancing Method field, select a load balancing method.

10. Optional: so that all requests from a single user within a session are processed by one server behind the firewall, in the Persistence field, select HTTP Cookie. Learn more about session persistence in the Session persistence section of the Load balancing protocols and methods instruction.

11. In the Health Check field, select the health check you created in step 2.

12. Optional: to use a single TCP connection with the server behind the firewall when processing multiple HTTP requests, enable the HTTP Multiplexing toggle.

13. Optional: to preserve the user's IP address in the X-Forwarded-For HTTP header, enable the Preserve Client IP toggle.

14. In the Real Servers section, click Create New.

15. In the IP Address field, enter the private IP address of the server behind the firewall.

16. In the Port field, enter the port of the server behind the firewall to which requests will be forwarded. By default, it is port 80.

17. Click OK.

18. Repeat steps 14–17 for every server behind the firewall that you want to add to load balancing.

19. Click OK.

CLI

1. Connect to the firewall.

2. Create a Virtual Server:

   config firewall vip
      edit "<virtual_server_name>"
         set type server-load-balance
         set ldb-method <load_balancing_method>
         set extip <public_ip_address>
         set extintf "<eth_name>"
         set server-type http
         set extport <public_port>
         set monitor "<health_check_name>"
         config realservers
            edit 1
               set ip <real_server_ip_1>
               set port <real_server_port_1>
            next
            edit 2
               set ip <real_server_ip_2>
               set port <real_server_port_2>
            next
         end
      next
   end

   Specify:

   • <virtual_server_name> — virtual server name;

   • <load_balancing_method> — load balancing method:

     • static — Static;
     • round-robin — Round Robin;
     • weighted — Weighted;
     • least-session — Least Session;
     • least-rtt — Least RTT;
     • first-alive — First Alive;
     • http-host — HTTP Host;

   • <public_ip_address> — public IP address of the firewall that you received in the ticket after ordering the firewall;

   • <eth_name> — firewall interface name to receive requests only through this interface. You can view the list of interfaces using the show system interface command. To receive requests through all interfaces, specify any;

   • <public_port> — port on the firewall that incoming requests will arrive at;

   • <health_check_name> — name of the health check you created in step 2;

   • optional: set persistence http-cookie — enables session persistence; all requests from a single user within a session will be processed by one server behind the firewall. Learn more about session persistence in the Session persistence section of the Load balancing protocols and methods instruction. Disabled by default;

   • optional: set http-multiplex enable — enables the use of a single TCP connection with the server behind the firewall when processing multiple HTTP requests. Disabled by default;

   • optional: set http-ip-header enable — enables preserving the user's IP address in the X-Forwarded-For HTTP header. Disabled by default;

   • <real_server_ip_1>, <real_server_ip_2> — private IP addresses of the servers behind the firewall;

   • <real_server_port_1>, <real_server_port_2> — ports of the servers behind the firewall to which requests will be forwarded. By default, it is port 80.

   If you need to add more real servers, specify them in the config realservers code block in a single command on a new line. For example:

   config realservers
      edit 1
         set ip <real_server_ip_1>
         set port <real_server_port_1>
      next
      edit 2
         set ip <real_server_ip_2>
         set port <real_server_port_2>
      next
      edit 3
         set ip <real_server_ip_3>
         set port <real_server_port_3>
      next
   end

4. Create a security policy

A security policy determines what traffic the firewall will allow between its interfaces. For example, you can use a policy to allow HTTP traffic to a virtual server. If no security policies are created, all traffic is dropped.

Graphical interface

FortiOS 6.x

1. Connect to the firewall.
2. Go to Policy & Objects → IPv4 Policy.
3. Click Create New.
4. In the Name field, enter the name of the security policy.
5. In the Incoming Interface field, select the public interface of the firewall.
6. In the Outgoing Interface field, select the private interface of the firewall.
7. In the Source field, select all.
8. In the Destination field, select the virtual server you created in step 3.
9. In the Schedule field, select always.
10. In the Service field, select HTTP.
11. In the Action field, select Accept.
12. In the Inspection Mode field, select Proxy-based.
13. Disable the NAT toggle. The servers behind the firewall will receive the original connection IP addresses.
14. Click OK.

FortiOS 7.x

1. Connect to the firewall.
2. Go to Policy & Objects → Firewall Policy.
3. Click Create New.
4. In the Name field, enter the name of the security policy.
5. In the Incoming Interface field, select the public interface of the firewall.
6. In the Outgoing Interface field, select the private interface of the firewall.
7. In the Source field, select all.
8. In the Destination field, select the virtual server you created in step 3.
9. In the Schedule field, select always.
10. In the Service field, select HTTP.
11. In the Action field, select Accept.
12. In the Inspection Mode field, select Proxy-based.
13. Disable the NAT toggle. The servers behind the firewall will receive the original connection IP addresses.
14. Click OK.

CLI

1. Connect to the firewall.

2. View the used security policy numbers by displaying information about the configured security policies:

   show firewall policy

   The response will show information about the configured security policies. For example:

   config firewall policy
       edit 1
          set name "my_policy"
          set srcintf "lan"
          set dstintf "wan1"
          set action accept
          set srcaddr "all"
          set dstaddr "all"
          set schedule "always"
          set service "ALL"
          set nat disable
       next
   end

   Here, 1 is the security policy number.

3. Create a security policy:

    config firewall policy
        edit <policy_number>
           set name "<policy_name>"
           set inspection-mode proxy 
           set srcintf "<incoming_interface>"
           set dstintf "<outgoing_interface>"
           set srcaddr "all"
           set dstaddr "<virtual_server_name>"
           set action accept
           set schedule "always"
           set service "HTTP"
           set nat disable
        next
    end

   Specify:

   • <policy_number> — available security policy number;
   • <policy_name> — security policy name;
   • <incoming_interface> — firewall public interface name. You can view the list of interfaces using the show system interface command;
   • <outgoing_interface> — firewall private interface name. You can view the list of interfaces using the show system interface command;
   • <virtual_server_name> — name of the virtual server you created in step 3.

5. Verify load balancing operation

Graphical interface

FortiOS 6.x

1. Connect to the firewall.

2. Go to Monitor → Load Balance Monitor.

3. In the Real Server column, next to the real server IP address, click .

4. In the Status column, check the server status:

   • Up — the server is active, FortiGate forwards requests to it;
   • Down — the server is not responding, FortiGate does not forward requests to it.

FortiOS 7.x

1. Connect to the firewall.

2. Go to Dashboard → Status.

3. Click Add Widget and select Load Balance.

4. Click Add Widget.

5. On the dashboards page, click Load Balance.

6. In the Real Server column, next to the real server IP address, click .

7. In the Status column, check the server status:

   • Up — the server is active, FortiGate forwards requests to it;
   • Down — the server is not responding, FortiGate does not forward requests to it.

CLI

1. Connect to the firewall.

2. Check the status of the real servers:

   diagnose firewall vip realserver list

   The output will display information about the real servers. For example:

   vf=0 name=http_virtual_server/3 class=4 type=1 172.20.120.122:(3080-3080), protocol=6
   total=2 alive=1 power=0 ptr=50980085
   ip=192.168.101.2-192.168.101.2/80 adm_status=0 holddown_interval=300 max_connections=0 weight=1 option=01
   alive=1 total=1 enable=00000001 alive=00000001 power=0
   src_sz=0
   id=1 status=up ks=5 us=4 events=1 bytes=28540 rtt=12
   ip=192.168.101.3-192.168.101.3/80 adm_status=1 holddown_interval=300 max_connections=0 weight=1 option=01
   alive=0 total=1 enable=00000000 alive=00000000 power=0
   src_sz=0
   id=0 status=down ks=4 us=3 events=1 bytes=21380 rtt=8

   Here, the status parameter displays the current status of the real server:

   • status=up — the server is active, FortiGate forwards requests to it;
   • status=down — the server is not responding, FortiGate does not forward requests to it.

3. Verify traffic distribution between the real servers:

   diagnose sniffer packet <interface_name> '<filter>' <verbose>

   Specify:

   • <interface_name> — name of the firewall interface through which traffic enters the servers. For example, wan1;
   • <filter> — packet output filter. For example, port 80;
   • <verbose> — output verbosity level from 1 to 6. The higher the value, the more information is displayed.