FG HA problem

Hi ​@zizo-100 ,

If both FortiGate units are showing Role = Primary and the same hostname, even though HA settings look correct, there are a few things to verify.
First, determine where you're seeing this

• In the GUI under System > HA?

• Through SSH/CLI on each unit?

• In FortiManager ?

In a healthy Active-Passive cluster:

• The hostname is not a synchronized parameter

• One unit should be Primary (Master).

• The other should be Secondary (Slave).

Check the actual HA status from CLI

Run on both units:

get sys ha status

If both devices report themselves as Master/Primary, then the cluster is split.

Common causes

1. Heartbeat links are down (most common)

Check:

diagnose sys ha status

or

get system ha status

Verify heartbeat interfaces are up ? 

Also check:

diagnose hardware deviceinfo nic <heartbeat_interface>

A failed HA heartbeat link can cause both units to become Primary (split-brain).

2. Layer 2 connectivity issue on heartbeat network

Even if the interfaces are up, the heartbeat packets may not pass.

Check on Both FortiGate device:

diagnose sniffer packet <heartbeat_interface> none 6 0 l 

You should see HA heartbeat traffic from the peer.
 

3. Virtual Cluster issue (VDOM HA)

If multi-VDOM mode is enabled, verify you're not looking at different virtual clusters.

Check:

get system ha status

for VC information.
 

Most useful outputs

Can you provide the output of:

get system ha status
diagnose sys ha status
show sys global
show sys ha

from both of the FortiGate's?

That will quickly tell whether this is:

• a normal synchronized cluster,

• a split-brain condition,

• heartbeat failure,

• or just a hostname synchronization misunderstanding.

Reference Link : 

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone

Thanks,
Mayur Padma

The cluster is probably in split brain. The most common reason is HA link may be down.