Fortigate ha override command

[Umesh]

Hi All,

Can anybody explain how fortigate override command works.

If we have primary & secondary fortigate, since I have gone through fortigate officials document but couldn't understood in details.

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/123439/primary-unit-selection-with-overr...

thank you.

[FredPaul]

Hi!
The article you linked does explain this in detail, but I'll try to simplify it.

When you have a cluster one device is the master, and the other(s) is/are the slave(s). In order to determine which unit is the master, the Fortigates go through an election process as follows (with override disabled):

1. Number of monitored interfaces that are up (the highest number wins)
2. Age (uptime)
3. Priority
4. Serial Number

So if all devices have all monitored interfaces up, age is considered. If the age (uptime) difference is more than 300 seconds (by default) the unit with the highest uptime becomes the master. It the age difference is less than 300 seconds, priority is considered. If the priority is the same for all devices, the device serial number is the tie breaker.

With override enabled the election process looks like this:

1. Number of monitored interfaces that are up (the highest number wins)
2. Priority
3. Age
4. Serial Number

So, as long as the number of monitored interfaces up are the same, the device with the highest priority will become the master. Although this can be useful to ensure that the same unit is always master, it can also be dangerous. If, let's say, the master goes down for a long time (for example due to a power failure), and then comes back up, it will take over as the master, and the config on that master will be synced to the slaves. All changes done on the slaves while the master was down will be overwritten! So use with care.

Did that help explaining how override works?