🔥 FortiGate HA: What You MUST Know Before Hitting Production
Setting up a FortiGate High Availability (HA) cluster is easy, but running it reliably in production requires understanding the underlying mechanics.

Here is a breakdown of the critical architecture rules every network engineer needs to master:
⚡️ 1. Decouple the Core HA Concepts
Don't treat HA as a single monolithic process. Always separate these four distinct stages during design and troubleshooting:
Heartbeat: Continuous health checks between peer units.
Failure Detection: Deciding when a peer or monitored interface is actually down.

Election: The logic engine determining which unit becomes Primary.
Session Synchronization: Keeping active stateful connections alive across role shifts.

👑 2. The Primary Selection & Override Trap
Consider this standard configuration:
FGT-1 $\rightarrow$ Priority 200
FGT-2 $\rightarrow$ Priority 100
Enabling Override forces Priority to rank above Uptime during master election.

⚠️ The Critical Gotcha:
HA Override and Device Priority are NOT synchronized between cluster members.
Fortinet explicitly places these under non-synchronized configurations.

If you enable override on one unit, you must manually set it on the peer. Failing to do so creates severe, unpredictable election behavior after a failover.

💓 3. Heartbeat Timers: Faster Isn't Always Better
Configuring heartbeat parameters in FortiOS:
Plaintext

config system ha
    set hb-interval 2
    set hb-interval-in-milliseconds 100ms
    set hb-lost-threshold 20
end

💡 Pro Tip: Aggressive detection timers reduce failover time, but they dramatically increase the risk of false positives caused by temporary CPU spikes or transient switchport delays. Balance speed with cluster stability.

🛠 4. Independent Management (Reserved Management Interfaces)
Managing cluster members via a shared Virtual MAC can lead to routing headaches during troubleshooting.

Always design with Reserved Management Interfaces (ha-mgmt-interfaces):
Assigns a dedicated, static IP and gateway to each individual FortiGate unit.

Allows out-of-band access for SSH, HTTPS, SNMP, Syslog, and FortiAnalyzer logging.

Ensures reachability even during failover events (especially when tuning ha-direct).



💬 Discussion:
Do you run override enable in your enterprise clusters, or do you keep it disabled to avoid preemption flapping? Drop your thoughts below! 👇

#Fortinet #FortiGate #NetworkSecurity #HighAvailability #NetworkEngineering #CyberSecurity