Hello
Will shutting down of the Primary-FG via GUI be a graceful shutdown and immediately issue a failover to the Secondary-FG of the HA pair?
This is an FG-101F and I plan to do a:
system > shutdown
Reason is, I need to have only the Secondary-FG up and running as the true primary for troubleshooting purposes. Pretty new to this vendor and I want to ensure that it does fail over this way.
Thank you.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello bigkeoni64,
I can confirm that this way the primary fortigate will shut down. I have tested this on a cluster in my lab and it is doable via the GUI/CLI (with execute shutdown).
Regards,
Hi,
You can failover manually, there is no need to shutdown the primary unit.
please review this kb: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-force-HA-failover/ta-p/196696
Ahmad
Thanks for the article; however, Forti TAC is asking me to make sure the Primary is shutdown because we have to force an ISDB database update to the secondary and they want to make sure the Primary is completely out of the picture. This is why I want to be certain that the Primary is shutdown gracefully after the failover. Once we run the forced update "execute update-now" we will unseat and reseat the power chords to the Primary so it takes over once again.
Is there a follow up command to shutting down the primary after the secondary has taken over?
FG-HA1# execute ha failover set 1
If you have a correctly functioning cluster, then shutting down the primary would indeed cause a failover. There should be no requirement for any additional commands.
Hi,
we may have different opinion and point-of-view how we see the thing is done. But for me, just to make slave become primary in A-P configuration - should not cause the failover as long as all parameter is well maintained like monitoring port, uptime, and so fort. But ya, shutdown the primary which now acts as slave would impact no traffic.
Hello bigkeoni64,
I can confirm that this way the primary fortigate will shut down. I have tested this on a cluster in my lab and it is doable via the GUI/CLI (with execute shutdown).
Regards,
And it would be graceful, but still you would need to log in once again on the fortigate. Please check this list which sessions will be synced and which will have to reestablish the connection:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-session-failover-session-pickup/ta-p/19...
More about the session failover in the tabs from this handbook:
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/786852/session-failover
Regards,
Aleksandar
Thank you, Aleksandar. This is exactly what I was looking for verification on since I do not have any lab HA pair and I have to do this on customer production systems. I will use the CLI method of "execute shutdown" and then log back in and now the secondary is the Master.
Once I unseat and reseat the Primary FortiGate device, that should pick back up as the Master since it has a higher priority.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1522 | |
1020 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.