Troubleshooting Tips: FortiMail primary showing effective as failed

Description

This article describes a FortiMail HA cluster issue in which the Primary unit is marked as Failed and the Secondary unit as Primary.

Scope

FortiMail.

Solution

FortiMail in HA cluster is showing the HA status as below.

Primary:

Configured: Primary, Effective: Failed.

Secondary:

Configured: Secondary, Effective: Primary.

Check the System Event log; observe that the remote services failed a few times, and the Primary was set to failed mode.

As per the above log, this is because the HTTP service failed at the configured primary side, and the configured secondary device is telling the configured primary to change to a failed state for it to take over as primary.

This only happens if the remote service is enabled. When enabling remote service, the secondary FortiMail will connect to the primary unit to enable remote service to detect failure. If the secondary FortiMail failed to connect with that remote service after consecutive retries, it will tell the primary unit to change to a failed state, and it will become the new primary. The remote service can be configured at System -> High Availability -> Configuration -> Service Monitor.

The above figure shows that the remote HTTP at port 80 is enabled. The secondary FortiMail will connect to the HTTP service at the primary FortiMail to detect service failure. It will connect to the Primary FortiMail IP configured in the Member section.

To check on the service connection, on the configured secondary, do a telnet to that specific service. Below are examples to test connectivity on the HTTP service at port 80.

execute telnettest <primary IP>:80

The remote service issue needs to be solved before restoring the device to its configured role. If not, after restoring the device to its configured role, the issue will recur again after the secondary FortiMail failed to connect with the remote service for consecutive retries.