| Description | This article describes how to break a HA cluster and use one of the members as a standalone. |
| Scope | FortiGate. |
| Solution |
Before changing the HA mode of the FortiGate, one of the cluster members must be removed.
It is possible to remove it either by removing all the cables or also shutting down the FortiGate from CLI using:
execute shutdown
To access the secondary device's CLI and shut it down from its CLI. Refer to this KB article: Managing individual cluster units with the CLI command 'execute ha manage'
Note: To prevent a split-brain scenario in your network, it's essential to remove the cables connecting hbdev (Heart-Beat) interface only after disconnecting all other network cables. By following this procedure, it is possible to avoid the risk of triggering a split-brain situation, where both nodes in an HA configuration believe they are the Active/Primary device.
The CLI displays a message when the shutdown is complete.
Ensure that it is possible to connect to the FortiGate as a standalone device using console access or a management interface. Refer to this KB article: Technical Tip: How to connect to the FortiGate and FortiAP console port
Configure the active unit as a standalone in the GUI, as shown below.
In the active unit to configure as a standalone, run the commands below:
In Multi-VDOM mode:
config global config sys ha set mode standalone end
In Non-VDOM mode:
config sys ha set mode standalone end
This needs to be done when only one of the firewalls in the HA cluster is licensed and the other cluster member has an expired subscription. The License Information GUI Dashboard of the primary firewall will show expired despite having a valid subscription, as it is a requirement to have active licenses on both firewalls. Related article: Technical Tip: Precautions to take while breaking the HA and adding again |
