Fortigate HA port monitoring

Question

Hello, we have two 500D Fortigates in an HA Master / Slave relationship.They both have two redundant, identical uplink WAN connections (ports 13 and 14) and two redundant, identical LAN connections (ports 1 and 3). Ports 15 and 16 are the HA heartbeat links between both memebers of the cluster. In our situation, Is there any advantage of us configuring Link failover (port monitoring / interface monitoring) ?

I was thinking if the master Fortigate lost both LAN or WAN ports then the cluster would not failover because the heartbeats would still be working, however if we had port monitoring in place, then failover would occur. Does anyone agree with this ? See attached screenshot.

Thank you kindly for any advice.

btp · Answer

You would need port monitoring on both sides, as well as link-monitoring to the PE or anything that should be reachable in a normal situation. If you have one primary master (override enable, priority high) you need link-monitoring on primary wan-link only.

If something happens on your main link, that does not take down the interface (i.e. link-down beyond first node), link-monitor will save your ass.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded