Technical Tip: Fine tune the HA cluster failover times

Description

This article describes configuration options for fine-tuning HA cluster failover timing and behavior.

Scope

FortiGate.

Solution

1. Configure FortiGate to send more gratuitous ARP packets and reduce the timers between gratuitous ARP packets to help connected network equipment recognize the failover sooner.

config system ha
    set arps 20
    set arps-interval 2
end

The 'set arps 20' setting, with a default value of 5, configures the FortiGate to send 20 gratuitous ARP (GARP) packets after a failover. During an HA role transition, the new active (primary) unit must update ARP and MAC address tables on connected switches and hosts so traffic redirects to it. Sending more GARP packets improves the chance that every neighboring device learns the updated MAC/IP association, minimizing packet loss.

The 'set arps-interval 2' setting, with a default value of 8, defines the time between consecutive GARP broadcasts, in seconds. With an interval of 2 seconds, FortiGate sends ARP packets frequently, ensuring faster propagation of the new active unit’s address across the network. Together with 'set arps 20', this creates a 40-second re-announcement cycle (20 ARPs × 2 seconds), improving convergence speed at the cost of slightly higher control-plane traffic.

2. Configure a link-failed signal after a link failover to ensure the attached network equipment responds as quickly as possible to a link failure. When the FortiGate detects an interface failure or a role change, it briefly forces all data interfaces (except HA and management ports) down, causing attached switches to flush stale MAC entries. Once the interfaces come back up, the new primary sends GARP packets to ensure clean path learning and prevent asymmetric routing or traffic blackholing.

config system ha
    set link-failed-signal enable
end

3. Fine-tune the number of lost heartbeat packets and the heartbeat interval timers to detect a device failure more quickly.

config system ha
    set hb-interval 2
    set hb-interval-in-milliseconds 100ms
    set hb-lost-threshold 2
end

Both parameters work together to determine the actual time between HA heartbeat packets. They are not redundant; they serve complementary roles in determining the heartbeat interval. For example, with 'hb-interval' set to 2 and 'hb-interval-in-milliseconds' set to 100ms, FortiGate sends a heartbeat every 200 ms. Changing 'hb-interval-in-milliseconds' to 10ms with 'hb-interval' set to 2 results in a heartbeat every 20 ms. For more information, refer to Advanced HA heartbeat settings in the FortiOS 8.0.0 Administration Guide.

With 'hb-lost-threshold' set to 2, a failover can be triggered in 400 ms (2x100x2).

A lower 'hb-lost-threshold' allows FortiGate to detect a peer failure sooner, but it can also increase the possibility of a false failure detection when heartbeat packets are temporarily missed. Increasing the threshold provides more tolerance for missed heartbeat packets, but increases the time required to detect an actual failure.

Note: The 'hb-interval-in-milliseconds' parameter is restricted to a fixed set of allowable values and must be configured to either 100 or 10 milliseconds; no other values are supported.

The 'failover-hold-time' setting can be used when a delay before an HA failover is preferred. It specifies the time, in seconds, that FortiGate waits before performing the failover, with a configurable range of 0 to 300 seconds and a default value of 0. This setting can be used to avoid repeated HA role changes during a failover condition. For more information, refer to config system ha in the FortiOS version 8.0.0 CLI Reference.

Related article:

Technical Tip: Changing the HA heartbeat timers to prevent false failover.