HA Cluster causing WAN DHCP problems

[Schpantz]

I've been going around in circles with Fortinet Support and my ISP so wanted to see if anyone on here has experienced a similar problem.

My setup is two 61E Fortigates in a HA cluster with dual WAN connections to different ISPs. Originally running 5.4.5 firmware but have recently upgraded to 6.0.2 to see if it made any difference (it did, the problem is worse). Both of my ISPs assign a static IP using DHCP. I have two VDSL modems in bridge mode with the Fortigates behind these. WAN interfaces on the Fortigates are set to DHCP.

The problem is that when a DHCP lease on either of these connections expires the slave member sometimes seems to renew the lease before the master. This causes the internet connection to stop working, but if I manually fail over to the slave member it starts working again. Both of my ISPs only allow a single registered MAC address so to get this connection back to the primary member of the cluster I have to restart everything. After updating to 6.0.2 even restarting does not renew the DHCP lease and looks like I have to wait for the lease time to expire before the primary member will renew it again.

Fortinet's response was, 'You should be using a static IP on WAN interfaces'. OK that's fine but even if I use the details from the DHCP assignment, change it to static, and create a default route I don't get a connection. The response from the ISP is that this should work and it's a Fortigate problem...

Does anyone have a workaround to stop the slave member from renewing the DHCP lease or any guesses as to why I can't set a static IP on the WAN? I'm in Australia so this is a fibre-to-the-node NBN connection.

[Alexis_G]

Your HA is active - active ?

If yes, consider to switch to active - standby and connect 2 wan interfaces to ISP on each device. So that one Fortigate at a time will handle the traffic.

[Schpantz]

Sorry forgot to mention, it already is in active-standby with 2 wan interfaces on each connected to both ISPs. This makes it even harder to understand why the slave is taking the DHCP lease. It shouldn't be doing anything unless it fails over.

[Alexis_G]

I m sorry.

I just remembered.

Fortigate HA do not replicate DHCP setting of interfaces.

You must set to static. then troubleshoot why the routing is not working (while overiding the dhcp settings).

Maybe you need to ask you providers to switch to static , not via DHCP.