HA Override Disabled.

[Dipen]

I have two Firewalls in HA Cluster..Firewall A with Priority 128 and Firewall B with Priority 64. I have enabled ' Port Monitor' on wan Interface. Normally when everything is OK Firewall A is Master. If wan Interface of Firewall A goes down then Firewall B becomes master which is OK. But if wan Interface on Firewall A again comes up..It becomes master again..I do not want that The HA override is disabled on both firewalls.

[ede_pfau]

Specify both priorities with the same value. Reboot FGT A first. HA prio is not the only criterium for choosing the master. Uptime is, as is the serial number (I' m sure I' ve forgotten one other...)

[Maik]

Master election: first: number of good interfaces/ports (port monitor) second: uptime third: priority (higher number becomes master) fourth: serial number " set override" switches the position of uptime and priority.

[JohnnyBonus]

How is a good interface determined? I mean is it just physical link up/down or are there other checks? (traffic going, ping reply, other member visible in that port) Are the checks only for physical interface or logical also? Are the states of software processes monitored for HA? In other words, if for example IPS or routing daemon hangs, will there be failover?

[Maik]

How is a good interface determined? I mean is it just physical link up/down or are there other checks? (traffic going, ping reply, other member visible in that port) Are the checks only for physical interface or logical also?

Enable or disable port monitoring for link failure. Port monitoring (also called interface monitoring) monitors FortiGate interfaces to verify that the monitored interfaces are functioning properly and connected to their networks. You can monitor physical interfaces, redundant interfaces, and 802.3ad aggregated interfaces but not VLAN subinterfaces, IPSec VPN interfaces, or switch interfaces. You can monitor up to 16 interfaces. This limit only applies to FortiGate units with more than 16 physical interfaces. In a multiple VDOM configuration you can monitor up to 16 interfaces per virtual cluster. Enable HA remote IP monitoring by specifying the FortiGate unit interfaces that will be used to monitor remote IP addresses. You can configure remote IP monitoring for all types of interfaces including physical interfaces, VLAN interfaces, redundant interfaces and aggregate interfaces.

Are the states of software processes monitored for HA? In other words, if for example IPS or routing daemon hangs, will there be failover?

No. If a Daemon crashes it should be restarted by a watchdog. if a daemon hang' s its a case for the support to improve firmware quality