Monitoring VLAN interfaces

FortiGate HA clusters that use VLAN interfaces can take advantage of VLAN heartbeat monitoring to ensure VLAN connectivity is functioning correctly across all units. When this feature is enabled, the primary unit actively verifies communication with each subordinate unit over every configured VLAN interface. This mechanism also confirms that the upstream switch is correctly configured for those VLANs.

If the primary unit cannot reach a subordinate unit on a specific VLAN, the system records a link‑monitor event (log ID 20099) indicating that the corresponding VLAN interface has gone down.

Use the following CLI command to enable monitoring VLAN interfaces:

config system ha-monitor
    set monitor-vlan {enable | disable}
    set vlan-hb-interval <interval_seconds>
    set vlan-hb-lost-threshold <vlan-lost-heartbeat-threshold>
end

Command	Description
monitor-vlan {enable | disable}	Enable/disable monitor VLAN interfaces (default = disable).
vlan-hb-interval <interval_seconds>	The VLAN heartbeat interval defines how often heartbeat packets are sent (1 - 30 seconds, default = 5 seconds).
vlan-hb-lost-threshold <vlan-lost-heartbeat-threshold>	The threshold is the number of consecutive VLAN heartbeat packets that must be missed before the VLAN is considered down (1 - 60 packets, default = 3). For example, if 3 heartbeat packets are not received, the VLAN is marked as down.

With a vlan-hb-interval of 5 seconds and a vlan-hb-lost-threshold of 3, the system detects a VLAN failure after 5 × 3 = 15 seconds.

To check VLAN heartbeat monitor status:

Run the following command to view the HA VLAN heartbeat monitor status:

# diagnose sys ha vlan-hb-monitor

Example output:

2026-03-12 11:03:44 peer #1: serial_no: FGTSERIALNUMBER123, last_hb: 0 sec ago, active
2026-03-12 11:03:44 vlan_intf #2: dmz1      <-- #<VLAN>: interface
2026-03-12 11:03:44 peer #1: serial_no: FGTSERIALNUMBER123, last_hb: 0 sec ago, active
2026-03-12 11:03:44 vlan_intf #3: internal  <-- #<VLAN>: interface
2026-03-12 11:03:44 peer #1: serial_no: FGTSERIALNUMBER123, last_hb: 0 sec ago, active
...
2026-03-12 11:03:44 peer #1: serial_no: FGTSERIALNUMBER123, last_hb: 4219777 sec ago, not active
2026-03-12 11:03:44 vlan_intf #9: servers   <-- #<VLAN>: interface

To monitor VLAN heartbeat messages from the HA monitor daemon in real time:

# diagnose debug application hamonitord -1

Example error message:

# 2026-03-12 11:11:26 [vlan_hb_timer_func:139] sendto() failed: 100(Network is down)