FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
nprakash
Staff & Editor
Staff & Editor
Article Id 395622
Description This article describes an issue where HA failover does not happen immediately when link monitor fails. Initial HA failover is triggered only after the flip-timeout expires. 
Scope FortiGate v7.4.7 +,v7.6.0, v7.6.3.
Solution

This is the HA configuration and the LAN interface are being monitored : 

config system ha
    set group-name "HA-LAB"
    set mode a-p
    set hbdev "ha1" 50 "ha2" 50
    set session-pickup enable
    set override disable
    set priority 150
    set pingserver-monitor-interface "lan"
end

Link Monitor configuration:


config system link-monitor
    edit "ha-link-monitor"
        set srcintf "lan"
        set server "10.10.1.12" <----- Probes are sent to this server.
    next
end

 

LAN Interface configuration: 


config system interface
    edit "lan"
        set vdom "root"
        set ip 10.10.1.1 255.255.255.0
        set allowaccess ping https ssh snmp
        set type hard-switch
    next

end

 

config system virtual-switch
    edit "lan"
        set physical-switch "sw0"
        config port
            edit "port1"
            next
            edit "port2"
            next
            edit "x1"
            next
        end
    next

end

 

When X1 is brought down and the link monitor fails, HA failover does not happen. Initial failover happens only when the flip-out timer expires, which means the lowest value that can be set is 6 minutes.

Trigger: 

This issue happens only when the cluster uptime is less than 6 minutes.  This issue has been addressed on v7.6.4. 

 

Troubleshooting:

 

diagnose sys ha dump-by group
diag sys ha history read

diagnose debug application link-monitor -1

diagnose debug console timestamp enable
diagnose debug enable

 

Relevant articles: