We are having two firewalls A and B. The model is FortiGate 60E.

Both are running in HA where A is primary and B is secondary. The firewalls are running smoothly and traffic is flowing from the WAN interface of A firewall.

Now, due to some issues in the uplink, the WAN interface of A goes down but the WAN interface of B is up.


  1. How will the firewalls behave?
  2. What events will happen now in the firewall?
  3. Will B become primary, why / why not?
  • 1
    Most of the behaviour you're asking about depends on how you configured them. You will need to provide configuration details, else we'll just be guessing.
    – Teun Vink
    Commented Jan 28, 2020 at 8:07

2 Answers 2


Fortigate HA takes care of device failover, it doesn't handle link failover.

With multiple WAN links, you need to connect each link to both firewalls and then use a link failover mechanism, e.g. by metric or by policy. You might also want to use link health monitoring for make sure that the WAN link actually works (especially when run across a switch).

For an overview check https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-high-availability/HA_failoverLink.htm?Highlight=link%20failover

  • Well, it DOES handle link failover by monitoring the link status of interfaces, as the cited doc shows. This can be configured in the HA settings. But, often, having a link up signal on a port doesn't mean that traffic is able to flow across it, so you would set up a link monitor which uses e.g. ping to monitor that a remote host can be reached. If it fails, the cluster will fail over to the other member. (Yes, the term 'link' has 2 meanings in this context, as an electrical link on a port, and as a connection between hosts. Confusing.) Commented Jan 30, 2020 at 18:46
  • @user1016274 FG's link health monitoring is actually a network-layer feature while link usually refers to the physical-layer connection. ;-) Yes, there are many ways to achieve redundancy but it's better to fail over a device only when it is offline and not when an uplink fails.
    – Zac67
    Commented Jan 30, 2020 at 19:12

Fortigate firewall can operate three type of ha , and can provide services in two mode

Mode are

  1. active - passive mode 2)active - active mode

Types of hight availability (ha)

  1. device failure
  2. link failure
  3. session failure

Ha interface is connected between two active -passive firewall called as cluster firewall ha cable always send heart beat request to another firewall in cluster . Passive devices always listens for heart beat request from active firewall. When problem encounter on active drive active firewall stops sending heart beat packets passive wil become active within 3 seconds and total work load is and traffic will handle by passive device by shifting it's position from passive to active

Similar link failure ha works if any of the interface is down in ha firewall cluster work load will be shifted to another firewall within cluster

When failover happen between on cluster TCP or udp session might get interrupted to avoid this active firewall will safely handover session details to passive firewall which is shifting towards active..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.