Skip to main content
O
ozawa_h
Visitor III
April 28, 2026
Solved

Network architecture between ONU and Fortigate 600F HA Cluster

  • April 28, 2026
  • 9 replies
  • 100 views

I have 2 Fortigate 600F in a HA Cluster that needs to connect to 1 ONU. Currently, both Fortigate is connected to a L2 switch that is then connected to the ONU. However, when the ONU is rebooted, Fortigate is no longer able to obtain an ip address on the port used to connect to the ONU.

 

If I configure link monitor, would Fortigate be able to obtain ip address after rebooting ONU?

What is the recommended network configuration when using HA Cluster with ONU?

Best answer by sjoshi

@ozawa_h 

 

1) Create the Performance SLA (The Detection)
Setup link monitor on fgt. If using sdwan then perf sla can be used
https://community.fortinet.com/fortigate-3/technical-tip-link-monitor-explained-99053
config system link-monitor
    edit "1"
        set srcintf "port1"  >> wan interface
        set server "8.8.8.8"
    next
end

2) Create the CLI Script 
execute interface dhcp renew <wan-interface>

config system automation-action
    edit "dhcp script"
        set action-type cli-script
        set script "execute interface dhcp renew port4"
        set accprofile "super_admin"
    next
end

config system automation-trigger
    edit "Event"
        set event-type event-log
        set logid 22932
    next
end

config system automation-stitch
    edit "test"
        set trigger "Event"
        config actions
            edit 1
                set action "dhcp script"
                set required enable
            next
        end
    next
end

This will trigger the dhcp renew whenever there is a link failure (even if physical interface is up)

9 replies

OktaRianzani
OktaRianzani
Visitor III
April 28, 2026

Just sharing from experience — not a definitive answer!

Link Monitor won't fix this. It's designed for reachability checks and HA failover, not for triggering DHCP renewals.

What's actually happening: When the ONU reboots, the DHCP state resets on the ISP side — but FortiGate still sees the link as "up" through the L2 switch in between. Because the link never went down from FortiGate's perspective, it never sends a new DHCP request.

This is a classic issue when there's an L2 switch between FortiGate and the ONU.

Best fix: Whenever possible, connect the WAN directly to FortiGate — skip the L2 switch in between. This way, when the ONU reboots, FortiGate actually sees the link drop and will re-request DHCP automatically.

If a switch is unavoidable: Make sure link state changes (link down/up) properly propagate through the switch to FortiGate. Without this, DHCP re-trigger won't happen automatically.

Quick workarounds in the meantime:

Manually renew DHCP via CLI:

execute interface dhcp renew <wan-interface>

Or automate an interface flap when the ONU comes back online.

Curious how others handle DHCP recovery in similar HA + ONU setups — would love to hear!

    O
    ozawa_hAuthor
    Visitor III
    April 28, 2026

    Thanks. Does this imply that I’ll need 2 ONU when I have a HA Cluster or a ONU with multiple ports? I think the problem I’m having is that I have 2 vlans out from fortigate each with an interface. Since my ONU only have 2 ports, I have 2 L2 switches between fortigate and the ONU.

    It seems better to just connect each fortigate directly to each port on the ONU and separate the vlan internally behind the fortigate.

    sjoshi
    Staff
    sjoshi
    Staff
    April 28, 2026

    Hi ​@ozawa_h 

     

    You can refer below document for deployment of FGT a-p cluster

    https://docs.fortinet.com/document/fortigate/7.6.6/administration-guide/900885/ha-active-passive-cluster-setup

     

    When you say that FGT is not able to obtain IP address, is the FGT WAN connection DHCP?

    Further you can tshoot by collecting dhcp capture

     

    Once the issue is reproduced what changes are you going as of now to get the IP address?

    Thanks, Salon
      O
      ozawa_hAuthor
      Visitor III
      April 28, 2026

      Executing “execute interface dhcp renew <wan-interface>” now. Was hoping there’s a better way then detecting failure on network monitor and executing the command.

      sjoshi
      Staff
      sjoshi
      Staff
      April 28, 2026

      can you share simple diagram how your FGT and switches and ONU is connected with each other

      Thanks, Salon
      Terms & ConditionsAccessibility statement
      Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
      Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.