High Availability and System Management
FGCP mechanics
FortiGate clustering (FGCP) elects a primary by highest priority (1–255), then uptime, then serial number. Override is disabled by default, meaning the cluster does not preempt when a higher-priority unit returns - a returning unit stays secondary until failure. Enabling override with different priorities gives deliberate preemption; that pairing is a frequent test point.
Both units must share firmware version, HA group name and password, and VDOM mode. The primary pushes configuration to secondaries, but the full config must match before sync is confirmed - compare with diagnose sys ha checksum show (and per-VDOM diagnose sys ha checksum show <vdom>). Session pickup (set session-pickup) keeps stateful sessions across failover in active-passive; without it established TCP flows drop even though the new primary has the same config.
Monitored interfaces cause a failover when they go down; use link monitoring to fail over on upstream reachability instead. Traps: split-brain from a broken heartbeat path (use redundant heartbeat interfaces), virtual MAC addresses derived from the HA group ID (changing group ID breaks ARP caches upstream), and active-active requiring switch-side handling of virtual MACs rather than giving per-session load sharing to one flow.
System management
Know admin profiles and trusted hosts, two-factor admin login, configuration revisions and encrypted backups (restore across models fails unless checked), and the supported firmware upgrade path - you cannot jump arbitrary releases. Verify cluster health with get system ha status and diagnose sys ha status, and confirm sync after every change.