Device failure

If the primary FortiGate-7000 encounters a problem that is severe enough to cause it to fail, the secondary FortiGate-7000 becomes new primary FortiGate-7000. This occurs because the secondary FortiGate-7000 is constantly waiting to negotiate to become primary FortiGate-7000. Only the heartbeat packets sent by the primary FortiGate-7000 keep the secondary FortiGate-7000 from becoming the primary FortiGate-7000. Each received heartbeat packet resets a negotiation timer in the secondary FortiGate-7000. If this timer is allowed to run out because the secondary FortiGate-7000 does not receive heartbeat packets from the primary FortiGate-7000, the secondary FortiGate-7000 assumes that the primary FortiGate-7000 has failed and becomes the primary FortiGate-7000.

The new primary FortiGate-7000 will have the same MAC and IP addresses as the former primary FortiGate-7000. The new primary FortiGate-7000 then sends gratuitous ARP packets out all of its connected interfaces to inform attached switches to send traffic to the new primary FortiGate-7000. Sessions then resume with the new primary FortiGate-7000.