Fortigate 5.6.2: HA Active/Standby: MAC address on WAN interfaces shared?

In a-p mode, HA assigns a virtual MAC address to each interface so all members use the same one when one of them takes over the primary role.

Completely unrelated, but a cable provider in TX - Spectrum admitted Hitron modems they installed have issues with VPN traffic. We have a couple of customers with a bunch of their locations in the area experiencing performance issue over our VPN. We're still in the middle of getting them replaced with a different type of modem, like Ubee. They're now saying the manufacturer is aware and providing new firmware to address the issue but we haven't gotten any indication of remote upgrade or unit swap. Just FYI.

When a cluster is operating, the FGCP assigns virtual MAC addresses to each primary unit interface. HA uses virtual MAC addresses so that if a failover occurs, the new primary unit interfaces will have the same virtual MAC addresses and IP addresses as the failed primary unit. As a result, most network equipment would identify the new primary unit as the exact same device as the failed primary unit.

If the MAC addresses changed after a failover, the network would take longer to recover because all attached network devices would have to learn the new MAC addresses before they could communicate with the cluster.

If a cluster is operating in NAT/Route mode, the FGCP assigns a different virtual MAC address to each primary unit interface. VLAN subinterfaces are assigned the same virtual MAC address as the physical interface that the VLAN subinterface is added to. Redundant interfaces or 802.3ad aggregate interfaces are assigned the virtual MAC address of the first interface in the redundant or aggregate list.

If a cluster is operating in Transparent mode, the FGCP assigns a virtual MAC address for the primary unit management IP address. Since you can connect to the management IP address from any interface, all of the FortiGate interfaces appear to have the same virtual MAC address.