Troubleshooting Tip: Understanding Fail-Detect Feature Limitation on FortiGate

Description

This article describes the limitations of the fail-detect feature on FortiGate devices, specifically when used recursively. It explains how the feature may work as expected or exhibit unexpected behavior, and provides information on how to address these limitations.

Scope

FortiGate.

Solution

1. The concept of the fail-detect feature can be found here: 
   Failure detection for aggregate and redundant interfaces

2. To understand the fail-detect feature limitations on FortiGate, it is essential to note that the feature was not designed to handle recursive fail-detect alerts.
   When enabling the feature under two interfaces (monitoring each other), it may work as expected or exhibit unexpected behavior.
   
   

Example of configuration:

config system interface
    edit "agg1"
        set vdom "root"
        set fail-detect enable
        set fail-alert-method link-down
        set fail-alert-interfaces "agg2"
        set type aggregate
        set member "port1" "port2"
    next
    edit "agg2"
        set vdom "root"
        set fail-detect enable
        set fail-alert-method link-down
        set fail-alert-interfaces "agg1"
        set type aggregate
        set member "port3" "port4"
    next
end

3. In general, the expected reaction time of fail-detect is around 2 seconds, which has been tested and documented in the KB article below: Technical Tip: What is the reaction time of fail-detect

However, if a recursive fail-detect configuration is implemented, the reaction time might be delayed (~10 seconds), and the delay can be observed usually during the first setup/after device reboot.

4. The fail-detect feature is not supported on software or hardware switch interfaces; it is only available on physical and aggregate interfaces.

   
   

5. To address these limitations, FortiGate users can consider submitting a New Feature Request (NFR) to the Fortinet sales team for the recursive fail-detect feature.