Troubleshooting Tip: FortiGate HA link-failed-signal and switching MAC address tables

Description

This article describes the behavior of the HA 'link-failed-signal' error, which brings down (briefly shuts down) all interfaces of a unit if a monitored link is detected as down.

If the FortiGate HA cluster units are managed through a dedicated network management interface, the interface will not be brought down.

config system ha
    set link-failed-signal enable
    set ha-mgmt-interface "mgmt"
end 

Scope

Any supported version of FortiGate in HA.

Solution

When a FortiGate HA cluster is operating and a monitored interface fails on the primary unit, the primary unit becomes a subordinate unit, and another cluster unit becomes the primary unit.

Normally, after a link failover, the new primary unit sends Gratuitous ARP (GARP) packets to refresh the MAC forwarding tables of the switches connected to the cluster.

In some instances, switches ignore the GARP packets and continue to reference the MAC address for the port of the failed FortiGate and will keep sending packets.

It is possible to use the following command to cause a cluster unit with a monitored interface link failure to briefly shut down all of its interfaces (except the heartbeat interfaces and HA management Interface) after the failover occurs (the switch will detect the failure and will clear the MAC table):

config system ha
    set link-failed-signal enable
end  

Note: When link-failed-signal is enabled, the following interfaces are not included in the link flap process to avoid HA issues or loss of management access:

Heartbeat interfaces (hbdev): Remain active so the HA members can continue exchanging heartbeat messages.
HA management interface: Remains active when ha-mgmt-status is enabled, ensuring management access is maintained during failover.
802.3ad aggregate (LAG) interfaces: The LAG interface itself is not flapped. Instead, each member port updates its link status through LACP, and the LAG interface reflects those changes automatically.

Workaround:
This is as designed, and there is no workaround.

Disabling 'ha-mgmt-status' and 'link-failed-signal' will work on the management interface.

Problem verification:
Run the following CLI commands before triggering a monitored link failure:

diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application hatalk -1
diagnose debug enable

Confirm configuration status:
Verify the setting is globally active across the HA cluster:

get system ha | grep link-failed-signal

Related article:

Technical Tip: Updating MAC forwarding tables when an HA link failover occurs