Hello Everyone,
I am using device model 200 F. When failover happens from primary to secondary it takes 2 seconds. But the failover from secondary to primary takes 30 seconds.
any suggestion pls.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
you may need to enable session-pickup in your HA configuration.
set session-pickup enable
set session-pickup-connectionless enable
On ipsec tunnels you may need to add
set ha-sync-esp-seqno enable
Hi,
Thank you for your reply. Those are already enabled.
Do you mean traffic not passing when doing failback from secondary to primary?
Do you have BGP configured on FGT? If yes, routes are present after failback?
Verify connected switches has learnt the MAC of FGT in new switch port.
You can use below hatalk debugs to see the status of failover event and gratuitous ARP sent by FGT Primary(new master)
di de di
di de reset
di de app hatalk -1
di de console timestamp enable
di de en
(Run the above debugs on both devices and perform the failover failback activity)
Hi, Thank you for the update. Everything seems working but failover from secondary to primary takes 30 secs.
Created on 06-15-2023 08:53 AM Edited on 06-15-2023 09:03 AM
He mentioned failover or failback.
The first failover when all sessions are synced should be fast.
If you have override enabled for HA primary then you have to wait for the configurations, states, sessions, ... to sync before the primary will take over again.
Hi, Thank you. do you have how to reduce the time for failback?
First of all, how are you measuring those 2 and 30 sec? And how are you exactly simulating/triggering a fail-over and fail-back? 30 sec is generally the default delay timer if your switch port has port-fast disabled. Wondering if you're disconnecting the eth cable connected to a switch to simulate the primary failure.
Toshi
Toshi
Hi, Thank you.
we are simulating the failover by shutting the LACP ports on the primary firewall and we saw only 1 packet drop. But when we do a failback by unshut the ports on primary. This time it takes 25 to 30 drop packets.
What is the other end of the LACP ports? Check the log on the device when you unshut the ports on the primary FGT to see if they take 30 sec to come back up or immediate.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.