Technical Tip: Prevent OSPF routing refresh when configure HA active-passive with monitored port

[hazim]

Description	This article explains the behavior of OSPF routing refreshes when configuring HA active-passive with a monitored port.
Scope	FortiGate v7.0, v7.2, and above.
Solution	Here is the example of FortiGate with active-passive and monitored port configured. FGT1 is connected to switch1 via port2. FGT1 is connected to switch 2 via port3. FGT1 # get router info routing-table ospf Routing table for VRF=0 O 10.0.4.1/32 [110/102] via 10.0.0.2, port2, 00:05:42                        [110/102] via 10.0.1.2, port3, 00:05:42 When the switch1 device fails/shuts down, the FortiGate will trigger the HA monitor port. Thus, it will failover from FGT1 to FGT2 for a few seconds and switch back to the FGT1 as a primary due to the value of the monitored port being the same. This behavior will cause the OSPF routing to refresh and cause a longer downtime, which defeats the purpose of having an ECMP link to the destination on FGT1. To maintain the route without triggering the failover, we need to enable the configuration below: config system ha     set route-ttl 60     set route-wait 60     set route-hold 60     set failover-hold-time 3 <----- This can avoid flip caused by monitor port end The OSPF routing will not refresh, and FGT1 will continue to direct traffic to port3 via switch2 when switch1 is down.

[hazim]

Description	This article explains the behavior of OSPF routing refreshes when configuring HA active-passive with a monitored port.
Scope	FortiGate v7.0, v7.2, and above.
Solution	Here is the example of FortiGate with active-passive and monitored port configured. FGT1 is connected to switch1 via port2. FGT1 is connected to switch 2 via port3. FGT1 # get router info routing-table ospf Routing table for VRF=0 O 10.0.4.1/32 [110/102] via 10.0.0.2, port2, 00:05:42                        [110/102] via 10.0.1.2, port3, 00:05:42 When the switch1 device fails/shuts down, the FortiGate will trigger the HA monitor port. Thus, it will failover from FGT1 to FGT2 for a few seconds and switch back to the FGT1 as a primary due to the value of the monitored port being the same. This behavior will cause the OSPF routing to refresh and cause a longer downtime, which defeats the purpose of having an ECMP link to the destination on FGT1. To maintain the route without triggering the failover, we need to enable the configuration below: config system ha     set route-ttl 60     set route-wait 60     set route-hold 60     set failover-hold-time 3 <----- This can avoid flip caused by monitor port end The OSPF routing will not refresh, and FGT1 will continue to direct traffic to port3 via switch2 when switch1 is down.