Technical Tip: How to avoid unexpected HA behavior of FortiGate-VM running in VMware ESXi environment

Description

This article describes how to avoid unexpected HA behavior of FortiGate-VM on specific VMware ESXi environments.

Scope

VMware ESXi, FortiOS v7.2.2 and below, and v7.0.7 and below.

After shutting down the HA primary unit and then restarting it, the uptime for both nodes is zero, and it fails back to the former primary unit.

Solution

If HA broadcast heartbeat is configured on a FortiGate-VM HA pair on a specific VMware ESXi environment, the HA broadcast heartbeat packet is sent and received by itself.

This may cause unexpected HA behavior on the FortiGate-VM HA pair.

For example, sometimes HA uptime is reset to 0, and HA primary/secondary takes over unexpectedly.

According to the following VMware KB article, this may happen under specific conditions.

In a NIC teamed environment where multiple uplinks are configured for a virtual switch, and a port channel or LACP is not configured on the physical switch.

Duplicate Multicast or Broadcast Packets are Received by a Virtual Machine When the Interface is Operating in Promiscuous Mode

After enabling /Net/ReversePathFwdCheckPromisc, toggle Promiscuous Mode off and back on for the affected port group (or reboot/vMotion the FortiGate-VM) for the setting to take effect; an ESXi host reboot is not required.

To avoid the issue, on ESXi, '/Net/ReversePathFwdCheckPromisc' setting must be enabled with the following ESXCLI command,

esxcli system settings advanced set -o /Net/ReversePathFwdCheckPromisc -i 1