13. High Availability | Andrew Swartz Knowledge Base

Two or more FortiGate devices operate as an HA cluster
- One device is the primary FortiGate
- The primary sends its configuration to others in the cluster
- Sync session info, FIB, FortiGuard definitions, other information
Not primary is known as a standby
There are two HA operation modes
- Active Active
- Active Passive

All members must have the same:
- Model
- Firmware version
- Licensing
  - If different, the cluster uses the lowest-level license
- Hard drive configuration
- Operating mode (management VDOM)
Setup:
- Same HA group ID, group name, password, and heartbeat interface settings
- Identical interfaces on each member must be connected to the same layer 2 network
Best practice:
- Use at least two heartbeat interfaces
- Initially, switch DHCP and PPPoE interfaces to static configuration
Example:

config system ha
	set mode a-p
	set group-id 10
	set group-name "Training"
	set password <password>
	set hbdev "port3" 10 "port4" 20
end

Note: this sets priority on the heartbeat links, see image below: Study diagram

diagnose sys ha reset-uptime

Check the HA uptime difference
Process for negotiating a primary / secondary:
- Connected Monitored ports (greater) -> primary
- HA uptime (greater) -> primary
- Priority (greater) -> primary
- Serial number (greater) -> primary

config system ha
	set override enable
end

Force a failover
- Change the HA priority Note: This is the same as preempt on Cisco

Negotiation checks connected monitored ports, priority, uptime, then serial number. So now, priority falls before uptime.

Broadcasts hello packets for member discovery and monitoring
Synchronizes data from the primary
- Changes made on secondary devices, however, are synced with other members if the cluster is in sync
Monitors the health of the primary
- If the primary fails, the secondary devices elect a new primary
In active-active mode only
- Processes traffic distributed by the primary

New secondary is added to the cluster
The primary compares its configuration checksum against the new secondary checksum. If it is different, it sends its configuration

Types:
- Device failover
  - The secondary devices stop receiving hello packets from the primary
- Link failover
  - The link of one or more monitored interfaces goes down
- Remote link failover
  - One or more interfaces are monitored using the link health monitor
  - The primary fails if the accumulated penalty of all failed interfaces reaches the configured threshold
- Memory-based failover
  - Memory utilization on the primary exceeds the configured threshold and monitoring period
- SSD failover
  - FortiOS detects extended filesystem (Ext-fs) errors in an SSD
Identify failover protection type by looking at:
- Event logs, SNMP traps, and alert email record failover events
Enable session synchronization for seamless session failover
- Note, this cannot work with deepssl inspection profiles, as it terminates at the FortiGate

On the primary, each interface is assigned a virtual MAC address
- HA heartbeat interfaces are not assigned a virtual MAC address
Upon failover, the newly elected primary adopts the same virtual MAC addresses as the former primary
After failover, gratuitous ARP informs the network that the virtual MAC address is now reachable through a different FortiGate

get system ha status

Study diagram

diagnose sys ha checksum show

diagnose sys ha checksum cluster

diagnose sys ha checksum recalculate

execute ha manage <member_id> <admin_username>

execute ha manage ?

<id> please input peer box index
<0> subsidary unit FGVM010000077650