Fortinet · FortiOS 7.4 · Lesson 11 of 12

FGCP: heartbeat plus monitored ports, not a hope

Two FortiGates, one virtual MAC, one cluster IP. FGCP elects primary. If you forget heartbeat cables or you monitor the wrong port, failover is a coin toss. This lesson is the election and the proof — not every HA knob.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Cabled dedicated HA heartbeat (ha1/ha2).
Set override / priority / monitor interfaces honestly.
Know what session-pickup does and does not save.
Prove failover with a ping and get system ha status.

The ticket

Primary WAN unplugged. Cluster did not fail over because monitor-interface was only LAN. Heartbeat still happy. Users dead.

Quick interview answer

FortiOS FGCP (FortiGate Clustering Protocol) is the usual A-P (or A-A) cluster. Dedicated heartbeat interfaces, same FortiOS/firmware, same hardware. monitored interfaces trigger failover when a cable dies. session-pickup syncs sessions so some TCP survives; not magic for every UTM state. get system ha status is the first proof.

Two FortiGates in FGCP with heartbeat cables — Heartbeat up is not the same as WAN up.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

Heartbeat = “is my peer alive?”
Monitor-interface = “is my useful cable alive?”
Priority / override = who should be primary when both look fine.

https://fgt-hq.techclick-lab.in

Training mock · not live

Admin

DashboardPolicyVPNNetwork

System → HA

Cluster tc-fg-ha

Mode

Active-Passive

Group name / password

tc-fg-ha

Heartbeat interfaces

ha1, ha2

Monitor interfaces

port1 (WAN), port2 (LAN)

Session pickup

Enable

FortiOS 7.4 HA (FGCP). Training mock.

How to choose

A-P for this class and most HQ firewalls. A-A only if you understand session pickup and UTM limits. Never heartbeat across a busy data switch “for a while.”

Runbook

Side A — cables
ha1↔ha1, ha2↔ha2. Same build. Then HA config.
Side B — monitor
Monitor WAN and LAN. Set priority. Decide override enable (sticky primary) vs disable (don’t flap back).
Side C — fail a WAN
Unplug WAN on primary. Ping from Priya should survive or drop < few seconds. get system ha status shows new primary.

Who is primary?

get system ha status
# Master: fgt-hq   Serial: FGT60FXXXX
# Slave:  fgt-hq-2
# Monitor: port1: up  port2: up
# HBDEV: ha1 up  ha2 up

Four failures

1 · Heartbeat on a data VLAN

Storm / delay → split-brain risk. Dedicated links.

2 · Monitor the wrong NIC

Today’s ticket.

3 · Firmware mismatch

Cluster will not form cleanly.

4 · Override flapping

Primary keeps snatching back on a bouncing cable.

How to prove it

Close only when

1) HA status shows two members. 2) A WAN unplug actually elects the peer. 3) You know whether override will fail back. 4) Heartbeats are dedicated.

Traps

Looks healthy	Is not
Both units “up”	Not clustered — two actives (split-brain)
Heartbeat up	WAN monitor missing

FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview

Sources

FortiOS 7.4 — HA (FGCP, heartbeat, monitor interfaces, session pickup).