Technical Tip: FortiAnalyzer HA preemption

In FortiAnalyzer v7.4.7 and v7.6.2, preemption was introduced.

It is enabled by default when selecting the 'Preferred role' as Primary:

This setting can also be confirmed using the CLI command below:

FAZ1 # diagnose test application clusterd 97 priority get
faz-ha priority 220 preempt

And:

FAZ2 # diagnose test application clusterd 97 priority get
faz-ha priority 100 nopreempt

If, at any time, the role needs to be changed manually, the command below can be used:

diagnose ha failover
device-id DeviceID of new primary, or re-elect from backup FortiAnalyzers if not specified.

More on HA diagnose commands is available in ha diagnose (CLI reference).

This command will force the failover but it will not override the preemption settings. If preemption is left enabled, the FortiAnalyzer with preemption enabled will take the primary role again after few seconds.

Even if an HA failover is forced, preemption prevail after few seconds.

To disable preemption, both cluster members need to be configured with 'Preferred mode' Secondary.

As an exception, preemption is disabled during the upgrade process. After upgrading the secondary to a higher version build, HA preemption is temporarily disabled on the primary to allow manual switching of the primary to the secondary and upgrading the new secondary (old primary).