Fortinet FortiController-5913C Parts list manual

This FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide describes FortiController-5913C
hardware features, how to install a FortiController-5913C board in a FortiGate-5144C chassis, and how to configure the
FortiController-5913C system for your network.
The most recent versions of this and all FortiGate-5000 series documents are available from the FortiGate-5000 page of
the Fortinet Technical Documentation web site (http://docs.fortinet.com).
Access to Fortinet customer services, such as firmware updates, support, and FortiGuard services, requires product
registration. You can register your FortiController-5913C at http://support.fortinet.com.
FortiController-5913C
Session-Aware Load Balancing Cluster (SLBC) System Guide
FortiController-5913C Session-Aware Load Balancing
Cluster (SLBC) System Guide
10-500-259409-20160210

FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10-500-259409-20160210
http://docs.fortinet.com/
Cautions and Warnings
Environmental specifications
Operating Temperature – If this device is installed in a closed or multi-unit rack assembly, the rack’s ambient temperature
may be greater than the room’s ambient temperature. Make sure the rack environment is compatible with the manufacturer’s
maximum rated ambient temperature (Tma).
Température ambiante élevée — Si cet appareil est installé dans un cabinet fermé, la température ambiante du cabinet peut
être supérieure à la température ambiante de la pièce. Assurez- vous que l’environnement dans le cabinet est compatible avec
la température ambiante maximale du fabricant (Tma).
Air flow – For rack installation, make sure that the amount of air flow required for safe operation of the equipment is not
compromised. For free-standing installation, make sure that the appliance has at least 2 inches (5 cm) of clearance on each
side to allow for adequate air flow and cooling.
Ventilation — Pour une installation dans un cabinet, assurez-vous que la ventilation nécessaire au fonctionnement de
l’équipement n’est pas compromise. Pour une installation autonome, assurez-vous que l’appareil dispose d’au moins 2
pouces (5 cm) de dégagement de chaque côté pour permettre l’écoulement de l’air et un refroidissement adéquat.
Circuit overloading – To avoid overloading, use the ratings on the label. Consider the equipment’s connection to the supply
circuit and the effect that circuit overloading might have on current protection and supply wiring.
For redundant power sources, connect each to an IEC/UL Listed power source whose output rating is greater than or equal to
the equipment.
Surtension – Pour éviter de surcharger le circuit d’alimentation, référez-vous aux notes sur l’étiquette de l’équipement .
Envisagez l’effet que la surtension du circuit pourrait avoir sur la protection de surtension et le câblage d’alimentation .
Pour les sources d'alimentation redondantes, connectez chacun à une source d'alimentation Mis CEI / UL dont la cote de
rendement est supérieur ou égal à l'équipement.
Reliable earthing – Make sure all rack-mounted equipment is grounded. This includes supply connections (e .g . power
strips), not only direct connections to the branch circuit.
Mise à la terre – Assurez-vous que tout l’équipement est mis à la terre . Ceci comprend les connexions d’alimentation (par
exemple, les barres d’alimentation) en plus des connexions directes au circuit de dérivation.
Interference – If possible, use Shielded Twisted Pair (STP) Ethernet cables instead of Unshielded Twisted Pair (UTP) .
Interférence – Si possible, utilisez des câbles Ethernet de paire torsadée blindée (STP) plutôt que de paire torsadée non
blindée (UTP).
Mechanical loading – To avoid personal injury or damage to the appliance, Fortinet recommends that 2 or more people
together install the appliance into the rack. Balance the equipment to avoid uneven mechanical loading and tipping. Do not
place heavy objects on the appliance.
Installation – Pour éviter des blessures ou des dommages à l’appareil, Fortinet recommande que deux personnes ou plus
installent ensemble cet équipement dans un cabinet. L’installation du matériel à l’intérieur de la baie doit être effectuée de
façon à éviter toute situation dangereuse liée à une installation non conforme . Ne placez pas d’objets lourds sur l’appareil,
celui-ci n’étant pas conçu pour soutenir un poids additionnel.
Refer to specific Product Model Data Sheet for Environmental Specifications (Operating Temperature, Storage Temperature,
Humidity, and Altitude)
Safety
Moving parts — Hazardous moving parts. Keep away from moving fan blades.
Pièces mobiles – Pièces mobiles dangerouses. Se tenir éloigné des pales de ventilateurs mobiles.
Do not install this equipment in a home or public area accessible to the general population. When installed in schools, this
equipment must be installed in a location where access is restricted to trained personnel.
Dans les écoles, ce matériel doit être installé en lieu sûr, de façon à le rendre accessible seulement aux personnels qualifies.
Battery – Risk of explosion if the battery is replaced by an incorrect type. Do not dispose of batteries in a fire. They may
explode. Dispose of used batteries according to your local regulations. IMPORTANT: Switzerland: Annex 4.10 of SR814.013
applies to batteries.
Batterie – Risque d’explosion si vous remplacez la batterie par un modèle incompatible. Jetez les piles usagées selon les
réglementations locales en vigueur. IMPORTANT: Suisse: Annexe 4.10 de SR814.013 s’appliquant aux batteries.
警告
本電池如果更換不正確會有爆炸的危險
請依製造商說明書處理⽤過之電池

FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10-500-259409-20160210 3
http://docs.fortinet.com/
FortiController-5913C
Contents
Cautions and Warnings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Environmental specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Safety. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
FortiController-5913C system 5
Front panel LEDs and connectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Front panel connectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
FortiController-5913C session-aware load balancing (SALB) . . . . . . . . . . . . . . 8
Setting up a single-chassis SALB cluster . . . . . . . . . . . . . . . . . . . . . 11
Setting up an SLBC with two chassis . . . . . . . . . . . . . . . . . . . . . . . 11
Hardware installation 13
Installing CFP2 and SFP+ transceivers. . . . . . . . . . . . . . . . . . . . . . . . . 13
FortiController-5913C mounting components . . . . . . . . . . . . . . . . . . . . . 14
Inserting a FortiController-5913C board . . . . . . . . . . . . . . . . . . . . . . . . 15
Shutting down and Removing a FortiController-5913C board . . . . . . . . . . . . . 17
Resetting a FortiController-5913C board. . . . . . . . . . . . . . . . . . . . . . . . 19
Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
FortiController-5913C does not startup . . . . . . . . . . . . . . . . . . . . . . 20
FortiController-5913C status LED is flashing during system operation . . . . . . 20
Basic Configuration 21
SLBClicensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
FortiOS Carrier licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Licenses (Support, FortiGuard, FortiCloud, FortiClient, FortiToken
Mobile, VDOMs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Connecting to the FortiController-5913C GUI . . . . . . . . . . . . . . . . . . . . . 22
Connecting to the FortiController-5913C CLI . . . . . . . . . . . . . . . . . . . . . 22
Factory default settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Initial session-aware load balanced cluster setup . . . . . . . . . . . . . . . . . . . 23
Using the external management address to connect to all units in the cluster . . 25
Upgrading cluster firmware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Verifying the configuration and the status of the boards in the cluster . . . . . . . . 27
For more information 28
Training Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Technical Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Contents
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
410-500-259409-20160210
http://docs.fortinet.com/
Comments on Fortinet technical documentation . . . . . . . . . . . . . . . . . . . 28
Customer service and support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Fortinet products End User License Agreement . . . . . . . . . . . . . . . . . . . . 28
Regulatory Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Federal Communication Commission (FCC) – USA . . . . . . . . . . . . . . . . 30
Industry Canada Equipment Standard for Digital Equipment (ICES) – Canada . . 30
Voluntary Control Council for Interference (VCCI) – Japan . . . . . . . . . . . . 30
Bureau of Standards Metrology and Inspection (BSMI) – Taiwan . . . . . . . . . 30
China . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
European Conformity (CE) - EU . . . . . . . . . . . . . . . . . . . . . . . . . . 30

FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10-500-259409-20160210 5
http://docs.fortinet.com/
FortiController-5913C
FortiController-5913C system
The FortiController-5913C is an Advanced Telecommunications Computing Architecture
(ATCA) compliant session-aware load balancing hub/switch board that distributes IPv4
TCP and UDP sessions to multiple FortiGate-5000-series boards (called workers) over
the FortiGate-5144C chassis fabric backplane. The FortiController-5913C includes two
front panel 100Gbps C formfactor pluggable 2 (CFP2) interfaces (F1 and F2) for
connecting to100Gbps networks. The FortiController-5913C forms a session-aware load
balanced cluster and uses FortiASIC DP processors to load balance millions of sessions
to the cluster,providing up to 40 Gbps of traffic to each cluster member (each worker).
Performance of the cluster shows linear improvement if more workers are added.
Clusters canalsobe formed with one or two FortiController-5913Cs and up to 12
workers. All of theworkers must be the same model. Currently FortiGate-5001B,
FortiGate-5001C, FortiGate-5101C, and FortiGate-5001D workers are supported.
FortiGate-5001C and FortiGate-5001D workers can handle up to 40 Gbps of traffic.
FortiGate-5001B and FortiGate-5101C workers can handle up to10 Gbps.
The FortiController-5913C can also provide 40-gigabit fabric and 1-gigabit base
backplane channel layer-2 switching in a dual star architecture.
You should install the FortiController-5913C in a FortiGate-5144C chassis to meet
FortiController-5913C power requirements, to have access to a 40G fabric backplane,
and to have enough slots for the number ofworkers that the FortiController-5913C can
load balance sessions to.
In all ATCA chassis, FortiController-5913Cs are installed in the first and second
hub/switch slots (usually slots 1 and 2). A single FortiController-5913C should be
installed in slot 1 (but you can install it in slot 2). If you add a second
FortiController-5913C it should be installed in slot 2.
See the FortiGate-5000 Compatability Guide for up-to-date information about
FortiGate-5000 series chassis and other components that are compatible with the
FortiController-5913C.
Figure 1: FortiController-5913C front panel
Extraction
Lever
Retention
Screw
Extraction
Lever
Retention
Screw
OOS
LED
STA
LED
PWR
LED
F1 and F2
100Gbps Fabric Channel
CFP2 Network
Interfaces (data)
B1 and B2
10Gbps Base Channel
SFP+ Interfaces
(heartbeat and
management)
MGMT
10/100/1000 Copper
Management Interface
RJ-45
Console
USB
IPM
LED
(board
position)

Front panel LEDs and connectors FortiController-5913C system
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
610-500-259409-20160210
http://docs.fortinet.com/
Two FortiController-5913Cs can be installed in an active-passive HA configuration that
provides session failover protection.
Two FortiController-5913Cs can also be installed in the same chassis in dual
FortiController mode doubling the amount of network interfaces. The
FortiController-5913C in slot 1 always becomes the primary and the one in slot 2
becomes the backup.
You can also install FortiController-5913Cs in a second chassis with another set of
FortiGate workers to provide chassis failover protection.
The FortiController-5913C includes the following hardware features:
• One 1-gigabit base backplanechannel for layer-2 base backplane switching between
workers installed in the same chassis as the FortiController-5913C. This base
backplane channel includes 13 1-gigabit connections to up to 13 other slots in the
chassis (slots 2 to 14).
• One 40-gigabit fabric backplane channel for layer-2 fabric backplane switching
between workers installed in the same chassis as the FortiController-5913C. This
fabric backplane channel includes 13 40-gigabit connections to up to 13other slots in
the chassis (slots 2 to 14).
•Two front panel 100-gigabit CFP2 fabric channel interfaces (F1 and F2). In a session-
aware load balanced cluster these interfaces are connected to 100-gigabit networks
to distribute sessions to workers installed in chassis slots 3 to14. The speed of these
interfaces cannot be changed. You may need to use attenuators on these single or
split interfaces if their optical power is too high.
•Two front panel 10-gigabit SFP+ base channel interfaces (B1 and B2) that connect to
the base backplane channel. These interfaces are used for heartbeat and
management communication between FortiController-5913Cs. These interfaces can
also be configured to operate as 1-gigabit SFP interfaces.
•On-board FortiASIC DP processors to provide high-capacity session-aware load
balancing.
•One 1-gigabit out ofband management ethernet interface (MGMT).
•One RJ-45, RS-232serial console connection (CONSOLE).
•One front panel USB port.
•Mounting hardware.
•LED status indicators.
Front panel LEDs and connectors
From the FortiController-5913C font panel you can view the status of the LEDs to verify
that the FortiController-5913C is functioning normally. You also connect the
FortiController-5913C to your 100-gigabit network using the F1 and F2 front panel CFP2
connectors. The front panel also includes B1 and B2 SFP+ connectors for the base
channels, an Ethernet management interface (MGMT), an RJ-45 console port for
connecting to the FortiController-5913C CLI and a USB port. The USB port can be used
with any USB key for backing up and restoring configuration files.
FortiController-5913C front panel interfaces F1 and F2 appear on the
FortiController-5913C web-based manager and CLI as interfaces f1 and f2. In single
FortiController-5913C mode, workers see these as fctrl/1 and fctrl/2. In dual
FortiController-5913C mode, workers see these as fctrl1/1, fctrl1/2, fctrl2/1 and fctrl2/2.

FortiController-5913C system Front panel LEDs and connectors
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10-500-259409-20160210 7
http://docs.fortinet.com/
LEDs
Table 1: FortiController-5913C LEDs
LED State Description
OOS
(Out of Service)
Off Normal operation.
Amber A fault condition exists and the FortiController-5913C
blade is out of service (OOS). This LED may also flash
very briefly during normal startup.
PWR (Power) Green The FortiController-5913C is powered on.
STA (Status)
Off The FortiController-5913C is powered on.
Flashing
Green
The FortiController-5913C is starting up. If this LED is
flashing at any time other than system startup, a fault
condition may exist.
F1 and F2
Amber The correct cable is connected to the interface and the
connected equipment has power.
Flashing
Amber
Network activity.
Off No link is established.
B1 and B2
Green The correct cable is connected to the interface and the
connected equipment has power.
Flashing
Green
Network activity at the interface.
Off No link is established.
MGMT
Link/Act
(Left
LED)
Solid
Green
Indicates this interface is connected with the correct
cable and the attached network device has power.
Blinking
Green
Indicates network traffic on this interface.
Off No Link
Speed
(Right
LED)
Green Connection at 1 Gbps.
Amber Connection at 100 Mbps.
Off Connection at 10 Mbps.
IPM
Blue The FortiController-5913C is ready to be hot-swapped
(removed from the chassis). If the IPM light is blue and no
other LEDs are lit the FortiController-5913C has lost
power
Flashing
Blue
The FortiController-5913C is changing from hot swap to
running mode or from running mode to hot swap. This
happens when the FortiController-5913C is starting up or
shutting down.
Off Normal operation. The FortiController-5913C is in contact
with the chassis backplane.

FortiController-5913C session-aware load balancing (SALB) FortiController-5913C system
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
810-500-259409-20160210
http://docs.fortinet.com/
Front panel connectors
FortiController-5913C session-aware load balancing (SALB)
This section provides a brief introduction to FortiController-5913C session-aware load
balancing (SALB). For more information, including example configurations see the
FortiController Session-Aware Load Balancing Guide on the Fortinet documentation
website (http://docs.fortinet.com).
The FortiController-5913C uses 2 on-board FortiASIC DP processors to perform high-
performance session-aware load balancing (SALB). A single FortiController-5913C can
distribute millions of concurrent sessions to up to 12 workers and start millions of new
sessions a second. If a worker fails, sessions are re-distributed to the remaining workers.
Additional FortiController-5913Cs in the same chassis can be added for redundancy or to
increase the number of network interfaces. You can also add a second chassis for
chassis redundancy.
Table 2: FortiController-5913C connectors
Connector Type Speed Protocol Description
CONSOLE RJ-45 9600 bps
8/N/1
RS-232
serial
Serial connection to the
command line interface.
USB USB Not used.
F1 and F2
CFP2 (100
gigabit)
100-gigabit
full
Ethernet 100-gigabit CFP2 connection
to 100-gigabit networks. On
the FortiController-5913C GUI
and CLI these interfaces are f1
and f2. In single
FortiController-5913C mode,
workers see these as fctrl/1
and fctrl/2. In dual
FortiController-5913C mode,
workers see these as fctrl1/1,
fctrl1/2, fctrl2/1, and fctrl2/2.
B1 and B2
SFP+ (10
gigabit) or
SPF (1
gigabit)
10-gigabit full
1-gigabit
auto
1-gigabit full
Ethernet 10-gigabit SPF+ connection to
10-gigabit networks or
1-gigabit SPF connection to
1-gigabit networks. Small
form-factor pluggable
transceiver. For heartbeat and
management communication
between
FortiController-5913Cs.
MGMT
RJ-45 10/100/1000
Base-T
Ethernet Copper 1-gigabit connection
to 10/100/1000Base-T copper
networks for management or
system administration.

FortiController-5913C system FortiController-5913C session-aware load balancing (SALB)
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10-500-259409-20160210 9
http://docs.fortinet.com/
As a session-aware load balancer, the FortiController-5913C maintains the state for each
session and is capable of directing any session to any worker installed in the same
chassis. This session-awareness means that all traffic being processed by a specific
worker continues to be processed by the same worker. Session-awareness also means
that more complex networking features such as network address translation (NAT),
fragmented packets, complex UDP protocols, and complex protocols such as SIP that
use pinholes, can be load balanced by the cluster.
In a FortiController-5913C load balanced cluster, when a worker that is processing SIP
traffic creates a pinhole, this information is communicated to the FortiController-5913C.
The FortiController-5913C then knows to distribute the voice and media sessions to this
worker.
The FortiController-5913C supports adding and removing workers from the cluster. So
you can start with a small number of workers and add more as your requirements grow.
When a new worker is added to a chassis slot and switched to forticontroller mode the
cluster automatically detects it, synchronizes its configuration and begins sending new
sessions to it, maintaining existing sessions on the workers that were already in the
cluster. If a worker fails or is removed from the cluster, the FortiController-5913C detects
its absence and re-balances and redistributes sessions to the remaining workers.
The FortiController-5913C supports the following single-chassis SALB configurations:
• One FortiController-5913C and up to 12 workers. The FortiController-5913C receives
all sessions and load balances them to the workers. If the FortiController-5913C fails
the cluster fails.
• Two FortiController-5913Cs in HA mode and up to 12 workers. The primary
FortiController-5913C receives all sessions and load balances them to the workers. If
the primary FortiController-5913C fails, the backup FortiController-5913C takes its
place.
• Two FortiController-5913Cs in dual mode and up to 12 workers. Both
FortiController-5913Cs receive and load balance sessions to the workers. If a
FortiController-5913C fails the other FortiController-5913C continues to operate. All
sessions processed by the failed FortiController-5913C are lost.
• Four FortiController-5913Cs and up to 10 workers in a chassis with dual dual star
architecture (such as the FortiGate-5144C). The FortiController-5913Cs in slots 1 and
2 receive and load balance sessions to the workers. The FortiController-5913Cs in
slots 1 and 3 and the FortiController-5913Cs in slots 2 and 4 form redundant pairs. If
the FortiController-5913C in slot 1 fails, the FortiController-5913C in slot 3 takes over.
If the FortiController-5913C in slot 2 fails, the FortiController-5913C in slot 4 takes
over.
The SIP protocol uses known SIP ports for control traffic but dynamically uses a wide
range of ports for voice and other media traffic. To successfully pass SIP traffic through
a firewall, the firewall must use a session helper or application gateway to look inside the
SIP control traffic and determine the ports to open for voice and media. To allow the
voice and media traffic, the firewall temporarily opens these ports, creating what’s
known as a pinhole that temporarily allows traffic on a port as determined by the SIP
control traffic. The pinhole is closed when the voice or media session ends.
Session-aware load balancing does not support traffic shaping.

FortiController-5913C session-aware load balancing (SALB) FortiController-5913C system
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10 10-500-259409-20160210
http://docs.fortinet.com/
• Four FortiController-5913Cs and up to 10 workers in a chassis with dual dual star
architecture (such as the FortiGate-5144C). All four FortiController-5913Cs receive
and load balance sessions to the workers. If a FortiController-5913C fails the other
FortiController-5913Cs continue to operate. All sessions processed by the failed
FortiController-5913C are lost.
Figure 2: Example FortiController-5913C load balanced cluster
You can also create the following FortiController-5913C dual-chassis SALB
configurations:
• One FortiController-5913C and up to 12 workers in each chassis. The
FortiController-5913C in one chassis receives all sessions and load balances them to
the workers in that chassis. If that FortiController-5913C fails, all sessions failover to
the FortiController-5913C in the other chassis.
• Two FortiController-5913Cs in HA mode and up to 12 workers in each chassis. The
primary FortiController-5913C in one chassis receives all sessions and load balances
them to the workers in that chassis. If the primary FortiController-5913C fails,
sessions failover to the primary FortiController-5913C in the second chassis. If the
primary FortiController-5913C in the second chassis fails, sessions fail over to one of
the backup FortiController-5913Cs.
FortiGate
Worker Boards
Slots 3 to 14
Load Balanced Traffic
on Fabric Backplane
Management and
Control Traffic on
Base Backplane
Single
FortiController
Slot 1
Internal network
Management
(mgmt)
F1 (fctrl/f1)
F2 (fctrl/f2)

FortiController-5913C system FortiController-5913C session-aware load balancing (SALB)
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10-500-259409-20160210 11
http://docs.fortinet.com/
• Two FortiController-5913Cs in dual mode and up to 12 workers in each chassis. Both
FortiController-5913Cs in one of the chassis receive and load balance sessions to the
workers in that chassis. If a FortiController-5913C fails, the sessions fail over to the
FortiController-5913Cs in the other chassis.
Setting up a single-chassis SALB cluster
To form a single-chassis SALB cluster you must install a FortiController-5913C in chassis
slot 1, optionally a second FortiController-5913C in chassis slot 2 and configure HA and
load balancing settings.
You then install the workers in slots 3 and up and set them to forticontroller mode. The
workers find each other in the chassis and form a cluster. The worker with the lowest slot
number becomes the primary worker and the others become subordinate workers.
You connect the FortiController-5913C F1 and F2 front panel interfaces to networks. The
workers see these interfaces as fctrl/f1 and fctrl/f2.
Figure 2 shows a FortiController-5913C cluster consisting of one FortiController-5913C
and three FortiGate-5001D workers. FortiController-5913C front panel interface F1
(fctrl/f1) is connected to the Internet and front panel interface F2 (fctrl/f2) is connected to
an internal network.
Setting up an SLBC with two chassis
You can also form a two-chassis SLBC, where each chassis would include a
FortiController-5913C in slot 1 and optionally a second FortiController-5913C in slot 2.
You then install the workers in slots 3 and up in each chassis and set them to
forticontroller mode.
You connect the chassis 1 FortiController-5913C F1 and F2 front panel interfaces to
networks. The workers see these interfaces as fctrl/f1 and fctrl/f2.
The network connections to the FortiController-5913Cs in chassis 1 are duplicated with
the FortiController-5913Cs in chassis 2. If one of the FortiController-5913Cs in chassis 1
fails, the FortiController-5913C in chassis 2 slot 1 becomes the primary FortiController
and all traffic fails over to the FortiController-5913Cs in chassis 2.
Heartbeat, base control, base management, and session sync communication is required
between the chassis using the FortiController-5913C B1 and B2 interfaces. Connect all
of the B1 interfaces together using a 10 Gbps switch. Collect all of the B2 interfaces
together using another 10 Gbps switch. Using the same switch for the B1 and B2
interfaces is not recommended and requires a double VLAN tagging configuration.
The switches must be configured to support the following VLAN tags and subnets used
by the traffic on the B1 and B2 interfaces:
• Heartbeat traffic uses VLAN 999.
• Base control traffic on the 10.101.11.0/255.255.255.0 subnet uses VLAN 301.
• Base management on the 10.101.10.0/255.255.255.0 subnet uses VLAN 101.
• Session sync traffic between the FortiControllers in slot 1 uses VLAN 1900.
• Session sync traffic between the FortiControllers in slot 2 uses VLAN 1901.
See the FortiController Session-Aware Load Balancing Guide for complete setup details.

FortiController-5913C session-aware load balancing (SALB) FortiController-5913C system
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
12 10-500-259409-20160210
http://docs.fortinet.com/

FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10-500-259409-20160210 13
http://docs.fortinet.com/
FortiController-5913C
Hardware installation
Before use, the FortiController-5913C must be correctly installed into a FortiGate-5144C
chassis.
This chapter describes:
•Installing CFP2 and SFP+ transceivers
•FortiController-5913C mounting components
•Inserting a FortiController-5913C board
•Shutting down and Removing a FortiController-5913C board
•Resetting a FortiController-5913C board
•Troubleshooting
Installing CFP2 and SFP+ transceivers
You must install CFP2 transceivers to connect FortiController-5913C front panel F1 and
F2 interfaces to 100-gigabit networks. The CFP2 transceivers are inserted into the F1 and
F2 cage sockets on the FortiController-5913C front panel. You can install the CFP2
transceivers before or after inserting the FortiController-5913C board into a chassis.
You must install SR SFP+ transceivers for normal operation of FortiController-5913C B1
and B2 front panel interfaces. The FortiController-5913C ships with two SR SFP+
transceivers. You can also configure the B1 and B2 front panel interfaces to operate at
1-gigabit and install SFP transceivers. You can install these transceivers before or after
inserting the FortiController-5913C board into a chassis.
You can install the following types of transceivers for connectors B1 and B2:
• SFP+ SR (10 gigabits)
• SFP+ LR (10 gigabits)
• SFP (1gigabit)
To install QSFP+ or SFP+ transceivers
To complete this procedure, you need:
• A FortiController-5913C board
• CFP2or SFP+ transceivers
• An electrostatic discharge (ESD) preventive wrist or ankle strap with connection cord
1Attach the ESD wrist strap to your wrist and to an available ESD socket or wrist strap
terminal.
FortiController-5913C boards must be protected from static discharge and physical
shock. Only handle or work with FortiController-5913C boards at a static-free
workstation. Always wear a grounded electrostatic discharge (ESD) preventive wrist
strap when handling FortiController-5913C boards.

FortiController-5913C mounting components Hardware installation
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
14 10-500-259409-20160210
http://docs.fortinet.com/
2Remove the caps from QSFP+ or SFP+ cage sockets on the FortiController-5913C
front panel.
3Hold the sides of the transceiver and slide it into the cage socket until it clicks into
place.
FortiController-5913C mounting components
To install a FortiController-5913C board you slide the board into a hub/switch slot in the
front of an ATCA chassis (usually slot 1 or 2 of a FortiGate-5144C chassis) and then use
the mounting components to lock the board into place in the slot. When locked into place
and positioned correctly the board front panel is flush with the chassis front panel. The
board is also connected to the chassis backplane.
To position the board correctly you must use the mounting components shown in
Figure 3 for the right (bottom) of the FortiController-5913C front panel. The mounting
components on the left (top) of the front panel are the same but reversed. The
FortiController-5913C mounting components align the board in the chassis slot and are
used to insert and eject the board from the slot.
Figure 3: FortiController-5913C right (bottom) mounting components
Handling the transceivers by holding the release latch can damage the connector. Do
not force the transceivers into the cage slots. If the transceiver does not easily slide in
and click into place, it may not be aligned correctly. If this happens, remove the
transceiver, realign it and slide it in again.
FortiController-5913C boards are vertical when inserted into a FortiGate-5144C chassis,
but you also often see the board on a horizontal service or horizontally in an illustration.
Because of this, the descriptions in this document refer to left (top) and right (bottom)
mounting components.
Closed
Open
Alignment
Pin
Retention
Screw
Lock Handle
Alignment Pin
Retention
Screw
Lock
Handle
Handle
Hook
Alignment Pin
Retention
Screw
Lock
Hook
Alignment
Pin
Retention
Screw
Lock
Handle

Hardware installation Inserting a FortiController-5913C board
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10-500-259409-20160210 15
http://docs.fortinet.com/
The FortiController-5913C handles align the board in the chassis slot and are used to
insert and eject the board from the slot. The right (bottom) handle activates a microswitch
that turns on or turns off power to the board. When the right (bottom) handle is open the
microswitch is off and the board cannot receive power. When the right (bottom) handle is
fully closed the microswitch is on and if the board is fully inserted into a chassis slot the
board can receive power.
Inserting a FortiController-5913C board
The FortiController-5913C board must be fully installed in a chassis hub/switch slot
(usually slot 1 or 2), with the handles closed and locked and retention screws fully
tightened for the FortiController-5913C board to receive power and operate normally. If
the FortiController-5913C board is not receiving power, the HS LED glows solid blue and
all other LEDs remain off. See “Front panel LEDs and connectors” on page 6.
It is important to carefully seat the FortiController-5913C board all the way into the
chassis, to not use too much force on the handles, and to make sure that the handles are
properly locked. Only then will the FortiController-5913C board power-on and start up
correctly.
FortiController-5913C boards are hot swappable. The procedure for inserting
a FortiController-5913C board into a chassis slot is the same whether or not the chassis
is powered on.
To insert a FortiController-5913C board into a chassis slot
To complete this procedure, you need:
• A FortiController-5913C board
• An ATCA chassis with an empty hub/switch slot
• An electrostatic discharge (ESD) preventive wrist strap with connection cord
1Attach the ESD wrist strap to your wrist and to an ESD socket or to a bare metal
surface on the chassis or frame.
2If required, remove the protective metal frame that the FortiController-5913C board
has been shipped in.
3Insert the FortiController-5913C board into the empty hub/switch slot in the chassis.
You can reset the board without removing it from the chassis. See “Resetting a
FortiController-5913C board” on page 19.
Do not carry the FortiController-5913C board by holding the handles or retention
screws. When inserting or removing the FortiController-5913C board from a chassis slot,
handle the board by the front panel. The handles are not designed for carrying the
board. If the handles become bent or damaged the FortiController-5913C board may
not align correctly in the chassis slot.
FortiController-5913C boards must be protected from static discharge and physical
shock. Only handle or work with FortiController-5913C boards at a static-free
workstation. Always wear a grounded electrostatic discharge (ESD) preventive wrist
strap when handling FortiController-5913C boards.

Inserting a FortiController-5913C board Hardware installation
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
16 10-500-259409-20160210
http://docs.fortinet.com/
4Unlock the handles by squeezing the handle locks.
5Open the handles to their fully open positions.
6Carefully guide the board into the chassis using the rails in the slot.
Insert the board by applying moderate force to the front faceplate (not the handles) to
slide the board into the slot. The board should glide smoothly into the chassis slot. If
you encounter any resistance while sliding the board in, the board could be aligned
incorrectly. Pull the board back out and try inserting it again.
7Slide the board in until the alignment pins are inserted half way into their sockets in
the chassis.
8Turn both handles to their fully-closed positions.
The handles should hook into the sides of the chassis slot. Closing the handles draws
the FortiController-5913C board into place in the chassis slot and into full contact with
the chassis backplane. The FortiController-5913C front panel should be in contact
with the chassis front panel. When the handles are fully-closed they lock into place.
As the right (bottom) handle closes the microswitch is turned on, supplying power to
the board. If the chassis is powered on the HS LED starts flashing blue. If the board is
aligned correctly, inserted all the way into the slot, and the right (bottom) handle is
properly closed the HS LED flashes blue for a few seconds. At the same time the ACT
and HTY LEDs turn green. After a few seconds the HS LED goes out and the
FortiController-5913C firmware starts up. If the board is operating correctly, the front
panel LEDs are lit as described in Table 3 .
Unlock Handle
To avoid damaging the lock, make sure you squeeze the handles fully to unlock them
before opening. The handles should pop easily out of the board front panel.
Handle
Alignment Pin
Open
Alignment Pin
Lock
Handle

Hardware installation Shutting down and Removing a FortiController-5913C board
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10-500-259409-20160210 17
http://docs.fortinet.com/
If the board has not been inserted properly the HS LED changes to solid blue and all
other LEDS turn off. If this occurs, open the handles, slide the board part way out, and
repeat the insertion process.
9Once the board is inserted correctly, fully tighten the retention screws to lock the
FortiController-5913C board into position in the chassis slot.
Shutting down and Removing a FortiController-5913C board
To avoid potential hardware problems, always shut down the FortiController-5913C
operating system properly before removing the FortiController-5913C board from a
chassis slot or before powering down the chassis.
The following procedure describes how to correctly use the FortiController-5913C
mounting components described in “FortiController-5913C mounting components” on
page 14 to remove a FortiController-5913C board from an ATCA chassis slot.
FortiController-5913C boards are hot swappable. The procedure for removing
a FortiController-5913C board from a chassis slot is the same whether or not the chassis
is powered on.
To remove a FortiController-5913C board from a chassis slot
To complete this procedure, you need:
• An ATCA chassis with a FortiController-5913C board installed
Table 3: FortiController-5913C normal operating LEDs
LED State
OOS Off
Power Green
Status Off
ACC Off (Or flashing green when the system accesses the
FortiController-5913C flash disk.)
IPM Off
Tighten
Retention
Screw
Do not carry the FortiController-5913C board by holding the handles or retention
screws. When inserting or removing the FortiController-5913C board from a chassis slot,
handle the board by the front panel. The handles are not designed for carrying the
board. If the handles become bent or damaged the FortiController-5913C board may
not align correctly in the chassis slot.

Shutting down and Removing a FortiController-5913C board Hardware installation
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
18 10-500-259409-20160210
http://docs.fortinet.com/
• An electrostatic discharge (ESD) preventive wrist strap with connection cord
1Attach the ESD wrist strap to your wrist and to an ESD socket or to a bare metal
surface on the chassis or frame.
2Disconnect all cables from the FortiController-5913C board, including all network
cables and the console cable.
3Fully loosen the FortiController-5913C retention screws.
4Unlock the handles by squeezing the handle locks.
5Slowly open both handles a small amount (about 8 degrees) until the IPM LED flashes
blue.
6Keep the handles in this position until the IPM LED stops flashing and becomes solid
blue.
7Open the handles to their fully open positions.
Opening the handles turns off the microswitch, turns off all LEDs, and ejects the board
from the chassis slot. You need to use moderate pressure on the handles to eject the
board.
8Pull the board about half way out.
FortiController-5913C boards must be protected from static discharge and physical
shock. Only handle or work with FortiController-5913C boards at a static-free
workstation. Always wear a grounded electrostatic discharge (ESD) preventive wrist
strap when handling FortiController-5913C boards.
Loosen
Retention
Screw
Waiting for the IPM LED to change to solid blue makes sure that the board software
shutdowns completely before disconnecting it from backplane power.
To avoid damaging the lock, make sure you squeeze the handles fully to unlock them
before opening. The handles should pop easily out of the board front panel.
Handle
Alignment Pin
Open
Alignment Pin
Lock
Handle

Hardware installation Resetting a FortiController-5913C board
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
10-500-259409-20160210 19
http://docs.fortinet.com/
9Turn both handles to their fully-closed positions.
When the handles are fully-closed they lock into place.
10 Carefully slide the board completely out of the slot.
11 Re-attach the protective metal frame if you are going ship the FortiController-5913C
board or store it outside of a chassis.
Resetting a FortiController-5913C board
You can use the following procedure to reset a FortiController-5913C board without
removing it from the chassis.
To reset a FortiController-5913C without removing the board from the chassis
You do not have to loosen the retention screws or adjust the position of the
FortiController-5913C board to use this procedure.
To complete this procedure, you need:
• An ATCA chassis with a FortiController-5913C board installed
• An electrostatic discharge (ESD) preventive wrist strap with connection cord
1Attach the ESD wrist strap to your wrist and to an ESD socket or to a bare metal
surface on the chassis or frame.
2Unlock the right handle by squeezing the handle lock.
3Pivot the right handle open.
The handle can only pivot a short distance. Pivoting the right handle turns off the
microswitch which powers down the board, turning off all LEDs except the IPM LED
which turns on.
Fully Closed
and Locked
Alignment Pin
Handle
Close
Alignment Pin
Handle
FortiController-5913C boards must be protected from static discharge and physical
shock. Only handle or work with FortiController-5913C boards at a static-free
workstation. Always wear a grounded electrostatic discharge (ESD) preventive wrist
strap when handling FortiController-5913C boards.
Unlock Handle

Troubleshooting Hardware installation
FortiController-5913C Session-Aware Load Balancing Cluster (SLBC) System Guide
20 10-500-259409-20160210
http://docs.fortinet.com/
4After 10 seconds snap the right handle back into place.
The board powers up, the LEDs light and in a few minutes the FortiController-5913C
board operates normally.
Troubleshooting
This section describes the following troubleshooting topics:
•FortiController-5913C does not startup
FortiController-5913C does not startup
Positioning of FortiController-5913C handles and a few other causes may prevent a
FortiController-5913C board for starting up correctly.
All chassis: handles not fully closed
If the handles are damaged or positioned incorrectly the FortiController-5913C board will
not start up. Make sure the handles are correctly aligned, fully inserted and locked.
All chassis: Firmware problem
If the FortiController-5913C board is receiving power and the handles are fully closed,
and you have restarted the chassis and the FortiController-5913C still does not start up,
the problem could be with FortiOS. Connect to the FortiController-5913C console and try
cycling the power to the board. If the BIOS starts up, interrupt the BIOS startup and
install a new firmware image.
If this does not solve the problem, contact Fortinet Technical Support.
FortiController-5913C status LED is flashing during system operation
Normally, the FortiController-5913C Status LED is off when the FortiController-5913C
board is operating normally. If this LED starts flashing while the board is operating, a fault
condition may exist. At the same time the FortiController-5913C may stop processing
traffic.
To resolve the problem you can try removing and reinserting the FortiController-5913C
board in the chassis slot. Reloading the firmware may also help.
If this does not solve the problem there may have been a hardware failure or other
problem. Contact Fortinet Technical Support for assistance.