FortiGate HA Cluster Won't Form? An FGCP Troubleshooting Checklist

You configured HA on two FortiGates, connected the heartbeat cable, and waited. get system ha status still shows one unit on its own. Or worse: they formed a cluster, but the configuration never matches and changes keep disappearing.

FGCP (FortiGate Clustering Protocol) is strict on purpose. Two units only join when they agree on a short list of things. Check the list in order and you find the problem in minutes. The FGCP topic page explains how a working cluster behaves; this post is for when it doesn’t.

The mental model: a handshake with a checklist

The members talk over the heartbeat links. In each heartbeat a unit says, in effect: “this is my group, my mode, my firmware, my model, and here is proof I know the password.” If any item differs, the other unit ignores it. There is no partial cluster. That is why a single typo leaves both units alone and neither complains loudly.

The checklist

A working pair looks like this on both units:

config system ha
    set group-name "HQ-HA"
    set group-id 10
    set mode a-p
    set password <same-on-both>
    set hbdev "port3" 50
    set monitor "port1" "port2"
    set priority 200
end

Only priority differs between the two units, and it is meant to. Priority is not synchronized: each unit keeps its own.

Step 1: is the heartbeat even arriving?

Heartbeats are Ethernet frames with their own EtherType (0x8890 by default), not IP packets, so a ping across the heartbeat link proves nothing. Sniff for them on the heartbeat interface:

diagnose sniffer packet port3 'ether proto 0x8890' 4 10

No frames from the peer? The problem is physical or Layer 2: the cable, the wrong port in hbdev, or a switch in the middle that blocks or tags the frames. A direct cable between the units removes the switch from the question.

Step 2: who sees whom?

get system ha status

It lists the cluster members this unit can see, their serial numbers, priorities and which one is primary. If each unit lists only itself while heartbeat frames do arrive (Step 1), the units are hearing each other and rejecting each other: go back to items 2 to 6 of the checklist. A group ID, group name or password typo is the usual culprit.

Step 3: formed, but out of sync

Sometimes the cluster forms and the configuration still differs. Compare the checksums:

diagnose sys ha checksum cluster

If the all checksum is the same on every member, the configurations match. If not, compare the global and per-VDOM lines to find which part differs. Remember that some settings stay local to each unit by design, for example the host name, the HA priority and the reserved HA management interface, so they never cause a mismatch.

To check the secondary directly from the primary’s CLI:

execute ha manage <member-index> <admin-username>

Two clusters on one switch

The cluster’s virtual MAC addresses are built from the group ID. Two clusters on the same Layer 2 network with the same group ID share virtual MACs, and traffic for one cluster lands on the other. Give every cluster its own group ID.

”The wrong unit is primary after a reboot”

This one is not a fault. With override disabled (the default), the election compares, in order:

1. the most monitored interfaces up,
2. the highest age (HA uptime),
3. the highest device priority,
4. the highest serial number.

FGT-A has priority 200, reboots, comes back, and FGT-B stays primary. That is FGCP protecting you from a second failover: FGT-B is now older, and age is checked before priority. If you want the higher priority to always win, enable override on both units, and accept that every return of FGT-A causes a second failover.

Split brain: the one to prevent

If every heartbeat link fails while both units keep running, each thinks the other died and both become primary, with the same IP and MAC addresses. Use two heartbeat links on different interfaces, ideally direct cables, so one failed port or cable never splits the cluster.

Quick reference

Practice it

• The Fortinet NSE 4 program covers FGCP in Class 11, with an EVE-NG lab built for the free FortiGate-VM trial.
• Concepts first? Read FortiGate HA: FGCP active-passive and active-active, then browse the security library.