Fortinet black logo

FortiGate-7000 Handbook

Device failure

Copy Link
Copy Doc ID a7303a7c-f2e5-11ea-96b9-00505692583a:584714
Download PDF

Device failure

If the primary FortiGate-7000 encounters a problem that is severe enough to cause it to fail, the secondary FortiGate-7000 becomes new primary FortiGate-7000. This occurs because the secondary FortiGate-7000 is constantly waiting to negotiate to become primary FortiGate-7000. Only the heartbeat packets sent by the primary FortiGate-7000 keep the secondary FortiGate-7000 from becoming the primary FortiGate-7000. Each received heartbeat packet resets a negotiation timer in the secondary FortiGate-7000. If this timer is allowed to run out because the secondary FortiGate-7000 does not receive heartbeat packets from the primary FortiGate-7000, the secondary FortiGate-7000 assumes that the primary FortiGate-7000 has failed and becomes the primary FortiGate-7000.

The new primary FortiGate-7000 will have the same MAC and IP addresses as the former primary FortiGate-7000. The new primary FortiGate-7000 then sends gratuitous ARP packets out all of its connected interfaces to inform attached switches to send traffic to the new primary FortiGate-7000. Sessions then resume with the new primary FortiGate-7000.

Device failure

If the primary FortiGate-7000 encounters a problem that is severe enough to cause it to fail, the secondary FortiGate-7000 becomes new primary FortiGate-7000. This occurs because the secondary FortiGate-7000 is constantly waiting to negotiate to become primary FortiGate-7000. Only the heartbeat packets sent by the primary FortiGate-7000 keep the secondary FortiGate-7000 from becoming the primary FortiGate-7000. Each received heartbeat packet resets a negotiation timer in the secondary FortiGate-7000. If this timer is allowed to run out because the secondary FortiGate-7000 does not receive heartbeat packets from the primary FortiGate-7000, the secondary FortiGate-7000 assumes that the primary FortiGate-7000 has failed and becomes the primary FortiGate-7000.

The new primary FortiGate-7000 will have the same MAC and IP addresses as the former primary FortiGate-7000. The new primary FortiGate-7000 then sends gratuitous ARP packets out all of its connected interfaces to inform attached switches to send traffic to the new primary FortiGate-7000. Sessions then resume with the new primary FortiGate-7000.