OSPF Failover with HA A-P

[dauger]

Hello,

I have been working on setting up 2 Fortigate 200D firewalls in Active/Passive HA mode and running OSPF. I have attached an image which shows my current test environment. I have run into an issue where I can get the failover to occur within 3 seconds on either the WAN or LAN, but not both.

I've configured OSPF with the following information:

firewall1 # show router ospf config router ospf     set router-id 0.0.0.2     set spf-timers 2 4         config ospf-interface             edit "Peering"                 set interface "wan1"                 set ip 10.0.4.2                 set retransmit-interval 1                 set dead-interval 1                 set hello-multiplier 4             next         end         config network             edit 3                 set prefix 0.0.0.0 0.0.0.0             next         end         config redistribute "connected"             set status enable         end end

This is the HA configuration:

firewall1 # show system ha config system ha     set group-name "hagroup"     set mode a-p     set hbdev "port15" 50 "port16" 50     set hb-interval 3     set hb-lost-threshold 2     set helo-holddown 5     set arps 10     set arps-interval 1     set session-pickup enable     set ha-mgmt-status enable     set ha-mgmt-interface "mgmt"     set ha-uptime-diff-margin 1     set override disable     set monitor "port2" "wan1" end

In the case where the OSPF "restart-mode graceful-restart" is enabled, the failover on the WAN side takes between 7 and 11 seconds. The LAN side takes 1-3 seconds. If I disable the restart-mode, these times change. The WAN side takes 1-3 seconds while the LAN side takes 9-11 seconds.

Are there any suggestions that would allow us to use HA with OSPF and lower these failover times?

[emnoc]

You could try the following;

1: a shorter OSPF  hello interval

2: enable BFD

[dauger]

Thank you for the suggestions. Our hello interval is currently 250ms with the OSPF Fast Hello functionality. I'll look into testing BFD. The current router we're testing OSPF with is configured to match our current production environment, so I'm loathed to require additional OSPF changes to that equipment.

[dauger]

Hello,

I've had an opportunity to test with the BFD. I've verified that the BFD connections were properly working on the wan1 interface. I'm still experiencing the same issues as before. The failover times between port2 and wan1 are inconsistent based on how the OSPF restart-mode is configured.

[Antonio_Milanese]

Hi Dauger,

as said by Emnoc BFD it's a good way to speed-up RIB updating especially when fasthello it's not supported by some peers..but with fasthello + GR I would expect lower convergence time..so I think your problem it's FIB invalidation during node failover so the only missing piece it's to adjust HA route timers to hold-on during ospf restart;

config system ha set route-ttl 60 set route-wait 60 set route-hold 60 end

there is an old thread about an A-A scenario:

https://forum.fortinet.com/tm.aspx?m=106134

anyway double check that each peer comply with GR version/timers and there is not an ARP issue.

Regards,

Antonio