Skip to main content
nprakash
Staff & Editor
Staff & Editor
June 11, 2025

Technical Tip: When link monitor fails, HA failover does not happen until the flip-timeout expires

  • June 11, 2025
  • 0 replies
  • 1478 views
Description This article describes an issue where HA failover does not happen immediately when link monitor fails. Initial HA failover is triggered only after the flip-timeout expires. 
Scope FortiGate v7.4.7 +,v7.6.0, v7.6.3.
Solution

This is the HA configuration and the LAN interface are being monitored : 

config system ha
    set group-name "HA-LAB"
    set mode a-p
    set hbdev "ha1" 50 "ha2" 50
    set session-pickup enable
    set override disable
    set priority 150
    set pingserver-monitor-interface "lan"
end

Link Monitor configuration:


config system link-monitor
    edit "ha-link-monitor"
        set srcintf "lan"
        set server "10.10.1.12" <----- Probes are sent to this server.
    next
end

 

LAN Interface configuration: 


config system interface
    edit "lan"
        set vdom "root"
        set ip 10.10.1.1 255.255.255.0
        set allowaccess ping https ssh snmp
        set type hard-switch
    next

end

 

config system virtual-switch
    edit "lan"
        set physical-switch "sw0"
        config port
            edit "port1"
            next
            edit "port2"
            next
            edit "x1"
            next
        end
    next

end

 

When X1 is brought down and the link monitor fails, HA failover does not happen. Initial failover happens only when the flip-out timer expires, which means the lowest value that can be set is 6 minutes.

Trigger: 

This issue happens only when the cluster uptime is less than 6 minutes.  This issue has been addressed on v7.6.4. 

 

Troubleshooting:

 

diagnose sys ha dump-by group
diag sys ha history read

diagnose debug application link-monitor -1

diagnose debug console timestamp enable
diagnose debug enable

 

Relevant articles:

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!