Fortigate firewall HA switchover causing delay

[Lucky-Cement]

I have fortigate firewall acting as wifi controller as well, my issue here is that when I perform manual HA failover or upgrade the firewall, switchover is not seamless and it take at least 5 minutes to switch services for secondary unit. configuration is active passive

[filiaks1]

@Lucky-Cement  Also see VRRP virtual MACs | FortiGate / FortiOS 7.6.2 | Fortinet Document Library as having Virtual MAC could help.

-----

If the VRRP virtual MAC address feature is disabled (the default setting), the VRRP domain uses the MAC address of the primary router. On a FortiGate VRRP virtual router, this is the MAC address of the FortiGate interface that the VRRP router is added to. If the primary fails, when the new primary takes over, it sends gratuitous ARPs to associate the VRRP router IP address with the MAC address of the new primary (or the FortiGate interface that became the new primary).

When a VRRP virtual MAC address is enabled, the new primary uses the same MAC address as the old primary.

Since devices on the LAN do not have to learn a new MAC address for a new VRRP router in the event of a failover, this feature can improve network efficiency, especially in large and complex networks.

---------

[Lucky-Cement]

thanks for your response,

I am using dt-lacp on the interfaces on core switch, interface on firewall is 802.3ad Aggregate and no vrrp configuration done specifically.

I have firewalls in other segments as well and all are connected with core switch, only the firewall in question has this behavior, others are switch HA absolutely fine.

[jiahoong112]

Enabling session-pickup on connectionless protocols can help (udp, icmp): https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/955521/session-pickup