Monitoring cluster units for failover

If the primary unit in the cluster fails, the units in the cluster renegotiate to select a new primary unit. Failure of the primary unit results in the following:

• If SNMP is enabled, the new primary unit sends HA trap messages. The messages indicate a cluster status change, HA heartbeat failure, and HA member down.
• If event logging is enabled and HA activity event is selected, the new primary unit records log messages that show that the unit has become the primary unit.
• If alert email is configured to send email for HA activity events, the new primary unit sends an alert email containing the log message recorded by the event log.
• The cluster contains fewer FortiGate units. The failed primary unit no longer appears on the Cluster Members list.
• The host name and serial number of the primary unit changes. You can see these changes when you log into the web-based manager or CLI.
• The cluster info displayed on the dashboard, cluster members list or from the get system ha status command changes.

 

If a subordinate unit fails, the cluster continues to function normally. Failure of a subordinate unit results in the following:

• If event logging is enabled and HA activity event is selected, the primary unit records log messages that show that a subordinate has been removed from the cluster.
• If alert email is configured to send email for HA activity events, the new primary unit sends an alert email containing the log message recorded by the event log.
• The cluster contains fewer FortiGate units. The failed unit no longer appears on the Cluster Members list.

 

Viewing cluster status from the CLI

Use the get system ha status command to display information about an HA cluster. The command displays general HA configuration settings. The command also displays information about how the cluster unit that you have logged into is operating in the cluster.

Usually you would log into the primary unit CLI using SSH or telnet. In this case the get system ha status command displays information about the primary unit first, and also displays the HA state of the primary unit (the primary unit operates in the work state). However, if you log into the primary unit and then use the execute ha manage command to log into a subordinate unit, (or if you use a console connection to log into a subordinate unit) the get system status command displays information about this subordinate unit first, and also displays the HA state of this subordinate unit. The state of a subordinate unit is work for an active-active cluster and standby for an active-passive cluster.

For a virtual cluster configuration, the get system ha status command displays information about how the cluster unit that you have logged into is operating in virtual cluster 1 and virtual cluster 2. For example, if you connect to the cluster unit that is the primary unit for virtual cluster 1 and the subordinate unit for virtual cluster 2, the output of the get system ha status command shows virtual cluster 1 in the work state and virtual cluster 2 in the standby state. The get system ha status command also displays additional information about virtual cluster 1 and virtual cluster 2.

The command display includes the following fields.

Fields                      Description

Model          The FortiGate model number.

Mode            The HA mode of the cluster: a-a or a-p.

Group          The group ID of the cluster.

Debug          The debug status of the cluster.

ses_pickup     The status of session pickup: enable or disable.

load balance   The status of the load-balance-all keyword: enable or disable. Relevant to act- ive-active clusters only.

schedule       The active-active load balancing schedule. Relevant to active-active clusters only.

Master displays the device priority, host name, serial number, and cluster index of the primary (or master) unit.

Slave displays the device priority, host name, serial number, and cluster index of the subordinate (or slave, or backup) unit or units.

Master Slave

The list of cluster units changes depending on how you log into the CLI. Usually you would use SSH or telnet to log into the primary unit CLI. In this case the primary unit would be at the top the list followed by the other cluster units.

If you use execute ha manage or a console connection to log into a subordinate unit CLI, and then enter get system ha status the subordinate unit that you have logged into appears at the top of the list of cluster units.

number of vcluster

The number of virtual clusters. If virtual domains are not enabled, the cluster has one virtual cluster. If virtual domains are enabled the cluster has two virtual clusters.