Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
mbrowndcm
New Contributor III

Triggering an HA failover?

Hello, How does one go about trigger an HA failover from the CLI? Specifically, how does one go about trigger a failback to the cluster member with the highest weight? Thanks, Matt
" …you would also be running into the trap of looking for the answer to a question rather than a solution to a problem." - [link=http://blogs.msdn.com/b/oldnewthing/archive/2013/02/13/10393162.aspx]Raymond Chen[/link]
" …you would also be running into the trap of looking for the answer to a question rather than a solution to a problem." - [link=http://blogs.msdn.com/b/oldnewthing/archive/2013/02/13/10393162.aspx]Raymond Chen[/link]
9 REPLIES 9
Austin_M
New Contributor

to triiger a HA failover shutdown the monitored interface from the CLI and use ha override option so that a particular cluster member always becomes the master device .
mbrowndcm
New Contributor III

Thanks for your reply, Austin. What do you mean " shut down the monitored interface from the CLI" ? Do you mean the heartbeat interface? Support simply told me to run the following:
 diag sys ha reset-uptime
 
" …you would also be running into the trap of looking for the answer to a question rather than a solution to a problem." - [link=http://blogs.msdn.com/b/oldnewthing/archive/2013/02/13/10393162.aspx]Raymond Chen[/link]
" …you would also be running into the trap of looking for the answer to a question rather than a solution to a problem." - [link=http://blogs.msdn.com/b/oldnewthing/archive/2013/02/13/10393162.aspx]Raymond Chen[/link]
ede_pfau
Esteemed Contributor III

The diag command will simply eliminate the age of the cluster members as a criterion for choosing the primary unit. To shut down an interface via CLI would mean to put it ' administratively down' . If you' re in a test environment that might work. Pulling the cable is quicker though.

Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
mbrowndcm
New Contributor III

Thanks Ede. I am not in a test environment. Therefore, I will simply use diag sys ha reset-uptime.
" …you would also be running into the trap of looking for the answer to a question rather than a solution to a problem." - [link=http://blogs.msdn.com/b/oldnewthing/archive/2013/02/13/10393162.aspx]Raymond Chen[/link]
" …you would also be running into the trap of looking for the answer to a question rather than a solution to a problem." - [link=http://blogs.msdn.com/b/oldnewthing/archive/2013/02/13/10393162.aspx]Raymond Chen[/link]
Carl_Wallmark
Valued Contributor

another way to force HA-failover is to change the priority of the slave to a higher value then the master.

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
mbrowndcm
New Contributor III

Thanks Selective. How would I cause a fail back to the highest weighted member using this method?
" …you would also be running into the trap of looking for the answer to a question rather than a solution to a problem." - [link=http://blogs.msdn.com/b/oldnewthing/archive/2013/02/13/10393162.aspx]Raymond Chen[/link]
" …you would also be running into the trap of looking for the answer to a question rather than a solution to a problem." - [link=http://blogs.msdn.com/b/oldnewthing/archive/2013/02/13/10393162.aspx]Raymond Chen[/link]
Matthijs
New Contributor II

 config sys ha
 set override enable
 end
 
Carl_Wallmark
Valued Contributor

You can type this: execute manage ha <slave number> config system ha set priority <priority number> end

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
Prab

Triggering a failover depends upon how you have configured the failover in first place. Assuming that you have the default setup. The selection is done in a sequence:

Failed Monitored interfaces > Age >Device Priority > Serial number

 

There are following ways to trigger the failover:

1. Resetting one of the monitored interface on the primary unit. (Unplugging the cable or administratively shutdown the interface)

2. Resetting the age of the primary unit (diagnose sys ha reset-uptime)

3. Changing the device priority (this will not trigger the failover, you still need to trigger the failover afterwards)

4. Using diagnose sys ha set-as-master enable command on an unit will make it the primary unit until it is rebooted. (Not a recommended method & not supported by all models!)

 

Cheers,

Prab

Labels
Top Kudoed Authors