# FGCP: heartbeat plus monitored ports, not a hope

Source: https://ai.techclick.in/blog_fortigate_fgcp_ha_failover
Markdown: https://ai.techclick.in/blog_fortigate_fgcp_ha_failover.md
Publisher: Techclick Infosec Pvt Ltd

FGCP active-passive: heartbeat, monitor interfaces, session pickup. Dummy ha1/ha2.

## The ticket

 Primary WAN unplugged. Cluster did not fail over because monitor-interface was only LAN. Heartbeat still happy. Users dead.

  Quick interview answer

 FortiOS  FGCP  (FortiGate Clustering Protocol) is the usual A-P (or A-A) cluster. Dedicated heartbeat interfaces, same FortiOS/firmware, same hardware.  monitored interfaces  trigger failover when a cable dies.  session-pickup  syncs sessions so some TCP survives; not magic for every UTM state.  get system ha status  is the first proof.

  Hero · two chassis

 Heartbeat up is not the same as WAN up.
  Lab data · dummy only
 FortiGate  fgt-hq  mgmt  10.10.10.1  · WAN  203.0.113.10  · LAN  10.20.30.0/24  · FortiManager  10.10.10.5  · FortiAnalyzer  10.10.10.6  · Priya  10.20.30.80  · branch peer WAN  198.51.100.10  · Azure VPN GW public  203.0.113.50  · AWS VGW public  203.0.113.60 . RFC 5737. Not a customer.

## Mental model

- Heartbeat = “is my peer alive?”

- Monitor-interface = “is my useful cable alive?”

- Priority / override = who should be primary when both look fine.

     https://fgt-hq.techclick-lab.in

     Training mock · not live

       Admin

       Dashboard  Policy  VPN  Network

       System → HA

### Cluster tc-fg-ha

        Mode  Active-Passive

  Group name / password  tc-fg-ha

  Heartbeat interfaces  ha1, ha2

  Monitor interfaces  port1 (WAN), port2 (LAN)

  Session pickup  Enable

        Cancel  Save

   FortiOS 7.4 HA (FGCP). Training mock.

## How to choose

 A-P for this class and most HQ firewalls. A-A only if you understand session pickup and UTM limits. Never heartbeat across a busy data switch “for a while.”

## Runbook

- #### Side A — cables ha1↔ha1, ha2↔ha2. Same build. Then HA config.

- #### Side B — monitor Monitor WAN and LAN. Set priority. Decide override enable (sticky primary) vs disable (don’t flap back).

- #### Side C — fail a WAN Unplug WAN on primary. Ping from Priya should survive or drop
  Who is primary?  get system ha status
# Master: fgt-hq   Serial: FGT60FXXXX
# Slave:  fgt-hq-2
# Monitor: port1: up  port2: up
# HBDEV: ha1 up  ha2 up

## Four failures

### 1 · Heartbeat on a data VLAN

 Storm / delay → split-brain risk. Dedicated links.

### 2 · Monitor the wrong NIC

 Today’s ticket.

### 3 · Firmware mismatch

 Cluster will not form cleanly.

### 4 · Override flapping

 Primary keeps snatching back on a bouncing cable.

## How to prove it

  Close only when

 1) HA status shows two members. 2) A WAN unplug actually elects the peer. 3) You know whether override will fail back. 4) Heartbeats are dedicated.

## Traps

   Looks healthy  Is not

  Both units “up”  Not clustered — two actives (split-brain)
  Heartbeat up  WAN monitor missing

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       FGCP heartbeat answers…

           Is the peer chassis alive?
           Is Facebook blocked?
           Is FAZ full?
           Is the VIP mapped?

       Correct:  a . Concept.

       Q2
       WAN unplug did not fail over. Likely?

           WAN not in monitor-interface
           PSK wrong
           No VDOM license
           SSL-VPN port

       Correct:  a . Ticket.

       Q3
       session-pickup means…

           Some sessions sync so failover is less brutal
           Unlimited UTM state forever
           No need for policies
           Replaces FAZ

       Correct:  a . Interview.

       Q4
       Heartbeat should run on…

           Dedicated HA cables
           The same VLAN as YouTube
           SSL-VPN portal
           Azure Firewall

       Correct:  a . Failure 1.

       Q5
       First HA proof command?

           get system ha status
           execute factoryreset
           diagnose hardware testsuite
           get vpn ssl monitor

       Correct:  a . Runbook.

       Q6
       Two actives forwarding is…

           Split-brain — bad
           Ideal A-P
           Required for VIP
           A VDOM feature

       Correct:  a . Trap.

       Check answers
       Reset

  FortiGate class series:   FGT / FMG / FAZ  ·  First day  ·  Policy first match  ·  SNAT vs VIP  ·  Profiles + SSL  ·  debug flow  ·  IPsec S2S  ·  SSL-VPN vs RA  ·  SD-WAN SLA  ·  VDOM  ·  FGCP HA  ·  Interview

## Sources

- FortiOS 7.4 — HA (FGCP, heartbeat, monitor interfaces, session pickup) .

 Related:  FortiGate session factory  ·  VPN series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt