Shutting down the Primary of an HA pair

[bigkeoni64]

Hello

Will shutting down of the Primary-FG via GUI be a graceful shutdown and immediately issue a failover to the Secondary-FG of the HA pair?

This is an FG-101F and I plan to do a:

system > shutdown

Reason is, I need to have only the Secondary-FG up and running as the true primary for troubleshooting purposes. Pretty new to this vendor and I want to ensure that it does fail over this way.

Thank you.

[aahmadzada]

Hi,
You can failover manually, there is no need to shutdown the primary unit.

please review this kb: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-force-HA-failover/ta-p/196696

Ahmad

[bigkeoni64]

Thanks for the article; however, Forti TAC is asking me to make sure the Primary is shutdown because we have to force an ISDB database update to the secondary and they want to make sure the Primary is completely out of the picture. This is why I want to be certain that the Primary is shutdown gracefully after the failover. Once we run the forced update "execute update-now" we will unseat and reseat the power chords to the Primary so it takes over once again.

Is there a follow up command to shutting down the primary after the secondary has taken over?

FG-HA1# execute ha failover set 1

[Richie_C]

If you have a correctly functioning cluster, then shutting down the primary would indeed cause a failover. There should be no requirement for any additional commands.

[iskandar_lie]

Hi,

we may have different opinion and point-of-view how we see the thing is done. But for me, just to make slave become primary in A-P configuration - should not cause the failover as long as all parameter is well maintained like monitoring port, uptime, and so fort. But ya, shutdown the primary which now acts as slave would impact no traffic.

[anikolov · Accepted solution]

Hello bigkeoni64,

I can confirm that this way the primary fortigate will shut down. I have tested this on a cluster in my lab and it is doable via the GUI/CLI (with execute shutdown).

Regards,

PREVIEW

[anikolov]

And it would be graceful, but still you would need to log in once again on the fortigate. Please check this list which sessions will be synced and which will have to reestablish the connection:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-session-failover-session-pickup/ta-p/19...

More about the session failover in the tabs from this handbook:
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/786852/session-failover

Regards,

Aleksandar

[bigkeoni64]

Thank you, Aleksandar. This is exactly what I was looking for verification on since I do not have any lab HA pair and I have to do this on customer production systems. I will use the CLI method of "execute shutdown" and then log back in and now the secondary is the Master.

Once I unseat and reseat the Primary FortiGate device, that should pick back up as the Master since it has a higher priority.