Architecture & Overview

FortiGate High Availability (FGCP) relies on real-time configuration and session synchronization across heartbeat interfaces. When a configuration sub-table desyncs or an unmonitored switch port fails, the cluster risks split-brain operation or silent packet blackholing.

Applicable Subsystem Scope FortiGate Active-Passive (A-P) and Active-Active (A-A) clusters running FGCP.
💡 Behavior Shift Notice (FortiOS 7.2 ➔ 7.4+ Evolution)

In FortiOS 7.4+, HA checksums are computed hierarchically across 18 distinct configuration sub-tables. The secondary node automatically isolates mismatching sub-tables without requiring full reboot.

5-Phase Closed-Loop Execution Workflow

Click any step as you complete it to track progress and verify live impact.

01

Isolate Mismatched Sub-Table Checksums

Compare global and VDOM configuration checksum hashes across primary and secondary cluster nodes.

diagnose sys ha checksum cluster
diagnose sys ha checksum show root
02

Closed-Loop Secondary Checksum Recalculation

Force the secondary node to recalculate its internal configuration hash tree against active memory.

📡 PHASE 1: PRE-CHANGE BASELINE (T - 30s)

Capture current cluster sync status and mismatched subtable name:

get system ha status
diagnose sys ha checksum cluster
⚡ PHASE 2: APPLY SURGICAL CHANGE (T = 0s)

Trigger non-disruptive secondary checksum recalculation:

diagnose sys ha checksum recalculate
🔍 PHASE 3: LIVE IMPACT VERIFICATION (T + 10s)

Observe cluster synchronization state:

diagnose sys ha checksum cluster
🟢 SUCCESS: All 18 sub-tables match (Sync state = 1, All hashes identical).
🟡 INEFFECTIVE: Sub-table remains mismatched ➔ Check for local certificate or dynamic route override.
🔴 ADVERSE: Secondary drops from cluster ➔ Verify physical heartbeat link carrier state.
🔒 PHASE 4: SAFETY AUTO-TEARDOWN
diagnose debug disable
diagnose debug reset
🔄 PHASE 5: 1-CLICK ROLLBACK (UNDO BLOCK)
# If local override is stuck, clear override:
config system ha
    set override disable
end
03

Arm Remote Gateway Link Monitoring Tripwires

Ensure remote gateway link-failure tripwires are active to prevent silent split-brain blackholes.

config system ha
    set pingserver-monitor-interface "port1" "port2"
    set pingserver-failover-threshold 5
end
Continuous Self-Healing

Daily Knowledge Base Synchronization

This runbook is actively monitored by the Ferrite Sentinel Daemon. Newly published Fortinet Technical Tips and firmware bug fixes are automatically incorporated within 24 hours.