I85PREP
⌘ K
FCSS Enterprise Firewall 7.6 study materials
FCSS Enterprise Firewall 7.6 study resources

FCSS Enterprise Firewall 7.6: High Availability

FCSS Enterprise Firewall 7.6 · Work through your exam, one topic at a time.

All guide sections

High Availability

High Availability

High Availability tests FortiGate clustering: FGCP active-passive and active-active, FGSP, heartbeat design, election and failover, session synchronisation, and the checks you run when a cluster misbehaves. Expect questions where a cluster fails to fail over, or fails over when it should not.

Core rules

  • FGCP is native clustering: members share configuration and, with session pickup enabled, synchronise sessions. FGSP is different - independent units behind an external load balancer, synchronising sessions only.
  • Election. The highest priority wins (default 128). override is disabled by default, so a recovered unit does not pre-empt the running master. Group name and group ID must match across members; a mismatch prevents the cluster forming.
  • Heartbeat. Dedicated hbdev ports carry FGCP frames (Ethertype 0x8890). Unicast heartbeat is available where broadcast between units is impossible. Do not carry user traffic on heartbeat ports.
  • Monitored interfaces. Each monitored interface has a weight (default 50); losing it lowers effective priority, and failover occurs only if the peer's priority is now higher.
  • Virtual MACs. The master uses a cluster MAC derived from the group ID, so peers and switches follow the cluster IP after failover; gratuitous ARP announces the move.
  • Synchronisation checks. diagnose sys ha status and diagnose sys ha checksum show reveal out-of-sync objects; execute ha synchronize start forces a resync.

Worked example

Two units: master priority 200, slave 128, override enabled, port1 monitored with weight 50. The ISP link on port1 fails, so the master's effective priority becomes 150 - still above 128 - and no failover occurs while the site is down. Fix: raise the interface weight past 72 or lower the slave's priority, and confirm set monitor actually includes port1. Reasoning: failover compares effective priority, not raw link state.

Traps

Enabling override on both units and creating failover flapping; heartbeat traffic crossing a switch that drops the HA Ethertype; session pickup disabled so TCP sessions drop at failover; mismatched firmware or group ID; assuming active-active load-shares every flow rather than per-session.