FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
lestopace
Staff
Staff
Description This article describes how to configure HA failover delay when monitored interface go down.
Scope FortiGate 7.0 and above.
Solution

In the following example, the failover-hold-time has been set to 30 seconds.

The value can be set from 0 to 300.

 

# config system ha

    set failover-hold-time <integer>

end

 

Results.

Before port3 at Bezza-kvm36 go down:

 

lestopace_0-1662715647102.png

 

 After port3 at Bezza-kvm36 went down:

 

lestopace_2-1662700652433.png

 

Fail-over occurred after 30 seconds:

 

lestopace_0-1662700531171.png

 

Note.

The same command is also the solution when there is a premature failback after a monitored link goes down (i.e. when a switch connected to a particular unit was rebooted or its interface flapped).

 

Premature fail-back problem:

A second after FGVM020000-----7 became the master due to port3 being down, FGVM020000-----2 became master again.

 

lestopace_4-1662701152375.png

 

Adding failover-hold-timewill avoid flips caused by monitor interface failure.

 

 

Contributors