Fortinet Failover

[Logesh08]

Hello Everyone,

I am using device model 200 F. When failover happens from primary to secondary it takes 2 seconds. But the failover from secondary to primary takes 30 seconds.  

any suggestion pls.

[aguerriero]

you may need to enable session-pickup in your HA configuration.

set session-pickup enable
set session-pickup-connectionless enable

On ipsec tunnels you may need to add
set ha-sync-esp-seqno enable

[Logesh08]

Hi,

Thank you for your reply. Those are already enabled.

[Stephen_Daniel]

Do you mean traffic not passing when doing failback from secondary to primary?
Do you have BGP configured on FGT? If yes, routes are present after failback?

Verify connected switches has learnt the MAC of FGT in new switch port.
You can use below hatalk debugs to see the status of failover event and gratuitous ARP sent by FGT Primary(new master)

di de di
di de reset
di de app hatalk -1
di de console timestamp enable
di de en

(Run the above debugs on both devices and perform the failover failback activity)

[Logesh08]

Hi, Thank you for the update. Everything seems working but failover from secondary to primary takes 30 secs.

[aguerriero]

He mentioned failover or failback.

The first failover when all sessions are synced should be fast.

If you have override enabled for HA primary then you have to wait for the configurations, states, sessions, ... to sync before the primary will take over again.

[Logesh08]

Hi, Thank you. do you have how to reduce the time for failback?

[Toshi_Esumi]

First of all, how are you measuring those 2 and 30 sec? And how are you exactly simulating/triggering a fail-over and fail-back? 30 sec is generally the default delay timer if your switch port has port-fast disabled. Wondering if you're disconnecting the eth cable connected to a switch to simulate the primary failure. 

Toshi

Toshi

[Logesh08]

Hi, Thank you. 

we are simulating the failover by shutting the LACP ports on the primary firewall and we saw only 1 packet drop. But when we do a failback by unshut the ports on primary. This time it takes 25 to 30 drop packets.

[Toshi_Esumi]

What is the other end of the LACP ports? Check the log on the device when you unshut the ports on the primary FGT to see if they take 30 sec to come back up or immediate.