Equivalent HA priority and upgrades

[Geom]

Been thinking about this for a while. I' m guessing someone knows the answer. If you set the priority on a 2 member HA cluster to be the same, how can you control which node is the master? Is this even adviseable? What I' d like to do is to upgrade one node member at a time and control the failover of HA. Using the GUI to do it causes a failover and then another failback to the highest priority node. I' m thinking that if I set them to be the same priority, it will only failover once and then not back again to the original master. At that point how could I get active HA member to be the master? Thanks.

[ede_pfau]

Hi, if both priorities are set the same then the cluster will not do the second failover after upgrading the old master. This is intentionally so that the network experiences the least interruptions. I see max. 5 ping dropped during the upgrade of a FG-310B cluster this way. Have a look into the CLI Reference Guide for the section " config system ha" , " set subsecond" and " set uninterruptable-upgrade" for further options. Your question regarding the " active" HA member and the " master" unit is self-explanatory: in an A-P cluster the active unit is the master. Only the role of a unit (master or slave) changes after a failover but that doesn' t really matter. Both are identical to 99%. If you really want to let one unit be the master all the time - at the expense of additional downtime during an upgrade - then set the " HA override" option on this unit. See the HA Guide for a detailed discussion of the selection process (for 4.0MR2 on pages 29-39). Unit selection depends on priority, uptime, serial number and HA override setting.

[Geom]

I do normally want one of the firewalls to always be the master because of some spanning tree complexity and connectivity to other firewall/routers. If it fails to the other device it isn' t a huge deal, just less efficient. I think what I will do is set them to be the same priority, set subsecond enabled, set uninterruptable-upgrade enabled, set override disabled. When I am ready to move the traffic back to the original master after an upgrade, I will just raise the priority a little, move the master role back to the device I want, and then change the priority back to be equal. Does this sound reasonable?

[ede_pfau]

I would advise against this. In order to " move the master role back to the device I want" you' d have to fail a monitored link on the other unit - there is no command to fail-over a cluster out of the blue. Rather, define your designated master with ' override' set. A higher priority will not guarantee under all circumstances that this unit will become the primary unit. See my last post on the criteria for selection of the primary unit - " uptime" . With the ' master unit' having the override flag set you will cause a failback when doing the firmware upgrade, and that is while you are monitoring the cluster anyway. The additional delay you incur is the price you pay. The ' subsecond' option will normally only have an effect on clusters in transparent mode, cf. the HA Guide for this. More important is that you enable session failover, a.k.a. session pick-up. This will alleviate the effects of a failover (and failback) for your users. BTW, still using STP? Have you read the comments on the interaction of STP and clustering in the HA Guide, and the recommended settings?

[Geom]

Thanks.. I have read the guide. Unfortunately the options you are referring to aren' t always spelled out as to what scenario you should use them in, which is the reason I' m asking other experienced admins. As for the STP, yes I am using STP (actually mstp) throughout our network. I do have it disabled on the interfaces going to the Fortigate though. I think we are ok there. Again, thanks for the responses.