Primary FortiGate-7000 selection
Once two FortiGate-7000s recognize that they can form a cluster, they negotiate to select a primary FortiGate-7000. Primary FortiGate-7000 selection occurs automatically based on the selection criteria shown in the diagram below. After the cluster selects the primary FortiGate-7000, the other FortiGate-7000 becomes the secondary.
Negotiation and primary FortiGate-7000 selection also takes place if the one of the criteria for selecting the primary FortiGate-7000 changes. For example, an interface can become disconnected or a module can fail. After this happens, the cluster can renegotiate to select a new primary FortiGate-7000 using the same selection criteria.
If there are no module failures and if you haven't configured any settings to influence primary FortiGate-7000 selection, the FortiGate-7000 with the highest serial number becomes the primary FortiGate-7000.
This section highlights some aspects of primary FortiGate-7000 selection. For more details about how this works, see Primary unit selection.
Age and primary FortiGate-7000 selection
Age (or uptime) is also a factor in primary FortiGate-7000 selection. Normally when two FortiGate-7000s start, their uptimes are similar and do not affect primary FortiGate-7000 selection. However, during operation, if one of the FortiGate-7000s goes down the other will have a much higher age or uptime and will be selected as the primary FortiGate-7000 before checking priority and serial number.
In some cases, age differences can result in the wrong FortiGate-7000 becoming the primary FortiGate-7000. For example, if the FortiGate-7000 set to a high priority reboots, it will have a lower age than other FortiGate-7000 when it rejoins the cluster. Since age takes precedence over priority it will become the secondary FortiGate-7000 when it rejoins the cluster.
One way to resolve this issue is to reboot both FortiGate-7000s in the cluster at the same time to reset the age of both FortiGate-7000s. However, doing this would disrupt traffic. Instead you can use the following command to reset the age of one the primary FortiGate-7000 to zero.
diagnose sys ha reset-uptime
The primary FortiGate-7000 now has the lowest age and the other FortiGate-7000 will have the highest age and can then become the primary FortiGate-7000.
|
The diagnose sys ha reset-uptime command should only be used as a temporary solution. You should reboot the FortiGate-7000s during a maintenance window to permanently bring their ages back together. |
Device priority and primary FortiGate-7000 selection
In some situations you may want to select a FortiGate-7000 to always become the primary FortiGate-7000. You can do this by setting its device priority higher. You can change the device priority of an FIM from the System > HA GUI page or by using the following command:
config system ha
set priority <number>
end
The default priority is 128.
During negotiation, the FortiGate-7000 with the highest device priority becomes the primary FortiGate-7000.
Override and primary FortiGate-7000 selection
You can enable override to select a FortiGate-7000 to always becomes the primary FortiGate-7000. Enabling override changes how primary select works.
Module failure and primary FortiGate-7000 selection
If a module (FIM or an FPM) fails, the FortiGate-7000 cluster negotiates to select a new primary FortiGate-7000 and the FortiGate-7000 with the most operating modules becomes the primary FortiGate-7000.
You can also configure board failover tolerance to control how a FortiGate-7000 cluster responds to a module failure.
config system ha
set board-failover-tolerance <tolerance>
end
Where <tollerance> can be from 0 to 3. A tolerance of 0 (the default) means that if a single module fails in the primary FortiGate-7000, a failover occurs and the FortiGate-7000 with the fewest failed modules becomes the new primary FortiGate-7000. Higher failover tolerances mean that more module failures must occur before a failover occurs.
Verifying primary FortiGate-7000 selection
You can use the get system ha status command to verify which FortiGate-7000 has become the primary FortiGate-7000. The command output shows which FortiGate-7000 is currently operating as the primary FortiGate-7000. The following command output excerpt shows that the FortiGate-7000 labeled as chassis 2 has become the primary (master) FortiGate-7000:
get system ha status Master selected using: HA Health Status: OK Model: FortiGate-7000E Mode: HA A-P Group: 7 Debug: 0 Cluster Uptime: 0 days 16:42:5
... Master: CH16 , FG74E83E16000016, cluster index = 0 Slave : FG74E83E16000015, FG74E83E16000015, cluster index = 1 number of vcluster: 1 vcluster 1: work 10.101.11.20 Master: FG74E83E16000016, operating cluster index = 0 Slave : FG74E83E16000015, operating cluster index = 1 Chassis Status: (Local chassis ID: 2) Chassis ID 1: Slave Chassis Slot ID 1: Master Slot Slot ID 2: Slave Slot Chassis ID 2: Master Chassis Slot ID 1: Master Slot Slot ID 2: Slave Slot