Troubleshoot an HA formation

The following are requirements for setting up an HA cluster or FGSP peers.

Cluster members must have:

• The same model.
• The same hardware configuration.
• The same connections.
• The same generation.

The requirement to have the same generation is done as a best practice as it avoids issues that can occur later on. If you are unsure if the FortiGates are from the same generation, please contact customer service.

Troubleshooting common HA formation errors

One member keeps shutting down during HA setup (hard drive failure):

If one member has a hard drive failure but the other does not, the one with the hard drive failure will be shut down during HA setup. In this case, RMA the member to resolve the issue.

Split brain scenario:

A split brain scenario occurs when two or more members of a cluster cannot communicate with each other on the heartbeat interface, causing each member to think it is the primary. As a result, each member assumes the primary HA role and applies the same IP and virtual MAC addresses on its interfaces. This causes IP and MAC conflicts on the network, and causes flapping on L2 devices when they learn the same MAC address on ports connected to different FortiGates.

A split brain scenario is usually caused by a complete lost of the heartbeat link or links. This can be a physical connectivity issue, or less commonly, something blocking the heartbeat packets between the HA members. Another cause is congestion and latency in the heartbeat links that exceeds the heartbeat lost intervals and thresholds.

The following are common symptoms of a split brain scenario:

• The connections to the FortiGates in the cluster work intermittently when trying to connect with administrative access.
• Sessions cannot be established through the FortiGate, and the traffic drops.
• When logging in to the FortiGates using the console, get system ha status shows each FortiGate as the primary.

To resolve a split brain scenario:

• Be physically on-site with the FortiGates (recommended). If this is not possible, connect to the FortiGates using console access.
• Identify the heartbeat ports, and verify that they are physically connected and up.
• Verify that heartbeat packets are being sent and received on the heartbeat ports.
• Verify that the HA configurations match between the HA members. The HA mode, group-name, group-id, and password settings should be the same. Different group-id values will result in different virtual MAC addresses, which might not cause a MAC conflict. However, an IP conflict can still occur.
• If everything seems to be in working order, run get system ha status to verify that HA has formed successfully.

To avoid a split brain scenario:

• In a two-member HA configuration, use back-to-back links for heartbeat interface instead of connecting through a switch.
• Use redundant HA heartbeat interfaces.
• In a configuration where members are in different locations, ensure the heartbeat lost intervals and thresholds are longer than the possible latency in the links.