FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 270635
Description This article explains the behavior of OSPF routing refreshes when configuring HA active-passive with a monitored port.
Scope FortiGate v7.0, v7.2, and above.

Here is the example of FortiGate with active-passive and monitored port configured.




FGT1 is connected to switch1 via port2.
FGT1 is connected to switch 2 via port3.

FGT1 # get router info routing-table ospf
Routing table for VRF=0
O [110/102] via, port2, 00:05:42
                       [110/102] via, port3, 00:05:42


When the switch1 device fails/shuts down, the FortiGate will trigger the HA monitor port.

Thus, it will failover from FGT1 to FGT2 for a few seconds and switch back to the FGT1 as a primary due to the value of the monitored port being the same.


This behavior will cause the OSPF routing to refresh and cause a longer downtime, which defeats the purpose of having an ECMP link to the destination on FGT1.


To maintain the route without triggering the failover, we need to enable the configuration below:


config system ha
    set route-ttl 60
    set route-wait 60
    set route-hold 60
    set failover-hold-time 3 <----- This can avoid flip caused by monitor port


The OSPF routing will not refresh, and FGT1 will continue to direct traffic to port3 via switch2 when switch1 is down.