FortiGate HA Split-Brain: diagnose sys ha status Before You Pull a Cable

FortiGate · Techclick CLI troubleshooting lab

Both FortiGates think they are primary. Two devices are answering the same VIP. Users see intermittent resets.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on FortiGate for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

diagnose sys ha status on both boxes. If both say primary, heartbeat is dead. Restore HA1/HA2 first, then decide which config wins.

Why this ticket shows up

Split-brain happens when heartbeat interfaces fail but data interfaces stay up. Both boxes pass traffic and fight over the same MAC.

Symptoms operators actually see

• Two primaries

• Duplicate IP warnings on the switch

• Sessions reset every few seconds

• HA heartbeat down in logs

CLI first — copy this block

Run these on the FortiGate device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

diagnose sys ha status
get system ha status
diagnose sys ha checksum cluster
diagnose hardware deviceinfo nic port3
execute ha manage 0
diagnose debug application hatalk -1

How to read that output

You want one primary, one secondary, and matching config checksums. Two primaries plus a down heartbeat is split-brain, not a licensing issue.

Triage order

1. Read HA status on both serials

2. Identify which heartbeat ports are down

3. Restore or move heartbeat to a working pair

4. Compare checksums and pick the good config

5. Fail over once, not twice

Classic traps

What you see	Real cause	Fix
Reboot both	You lose the good config	Save one side first
Disable HA	Heartbeat cable is unseated	Reseat HA links
Change priority randomly	Checksums differ	Sync first

Proof the ticket is closed

• One primary, one secondary

• Checksums match

• VIP answers on one MAC

Say this in an interview

Two primaries means heartbeat died. I repair HA links before I touch priority.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/