Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Logesh08
New Contributor

Fortinet Failover

Hello Everyone,

I am using device model 200 F. When failover happens from primary to secondary it takes 2 seconds. But the failover from secondary to primary takes 30 seconds.  

 

any suggestion pls.

14 REPLIES 14
aguerriero
Contributor II

you may need to enable session-pickup in your HA configuration.

set session-pickup enable
set session-pickup-connectionless enable

On ipsec tunnels you may need to add
set ha-sync-esp-seqno enable

Logesh08

Hi,

 

Thank you for your reply. Those are already enabled.

Stephen_Daniel

Do you mean traffic not passing when doing failback from secondary to primary?
Do you have BGP configured on FGT? If yes, routes are present after failback?

Verify connected switches has learnt the MAC of FGT in new switch port.
You can use below hatalk debugs to see the status of failover event and gratuitous ARP sent by FGT Primary(new master)

di de di
di de reset
di de app hatalk -1
di de console timestamp enable
di de en

(Run the above debugs on both devices and perform the failover failback activity)

Logesh08

Hi, Thank you for the update. Everything seems working but failover from secondary to primary takes 30 secs.

aguerriero

He mentioned failover or failback.

The first failover when all sessions are synced should be fast.

If you have override enabled for HA primary then you have to wait for the configurations, states, sessions, ... to sync before the primary will take over again.

Logesh08

Hi, Thank you. do you have how to reduce the time for failback?

Toshi_Esumi
SuperUser
SuperUser

First of all, how are you measuring those 2 and 30 sec? And how are you exactly simulating/triggering a fail-over and fail-back? 30 sec is generally the default delay timer if your switch port has port-fast disabled. Wondering if you're disconnecting the eth cable connected to a switch to simulate the primary failure. 

 

Toshi

 

Toshi

Logesh08

Hi, Thank you. 

 

we are simulating the failover by shutting the LACP ports on the primary firewall and we saw only 1 packet drop. But when we do a failback by unshut the ports on primary. This time it takes 25 to 30 drop packets.

Toshi_Esumi

What is the other end of the LACP ports? Check the log on the device when you unshut the ports on the primary FGT to see if they take 30 sec to come back up or immediate.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors