FortiExpert logoFortiExpert
Sign in
← Back to knowledge base
medium

Collecting diagnostic information for FortiGate HA issues

Confirmed 8/8/2026

Problem

FortiGate High Availability (HA) problems require diagnostic output from both cluster members, including HA daemon debugging, status and checksum information, heartbeat packet captures, and event logs.

Symptoms

HA cluster formation failures, configuration or state synchronization problems, or no output from the hatalk or hasync debug processes.

Environment

FortiGate HA clusters, including Primary and Secondary units. Applies to NAT/Route mode and Transparent mode HA deployments.

Root Cause

The specific cause is unknown until diagnostics are reviewed. The hatalk daemon manages cluster communication and failure monitoring. The hasync daemon synchronizes configuration files, upgrades, IKE notifications, external files, the ARP table, and the forwarding information base (FIB). If these daemon debugs produce no output, the relevant processes may need to be restarted.

Solution

  1. Enable timestamps and collect the appropriate HA daemon debug.
diagnose debug enable
diagnose debug console timestamp enable

For cluster formation issues, run:

diagnose debug application hatalk -1

For HA synchronization issues, run:

diagnose debug application hasync -1

To initiate HA synchronization, run:

execute ha synchronize start

After collecting the required output, disable debugging:

diagnose debug disable
  1. If hatalk or hasync produces no debug output, identify the process IDs on each FortiGate:
diagnose sys process pidof hasync
diagnose sys process pidof hatalk

Restart the affected process by substituting its process ID:

diagnose system kill 11 <process_id>

Alternatively, a super administrator can terminate all running instances of both HA processes so that they restart:

fnsysctl killall hatalk
fnsysctl killall hasync
  1. Run the following commands on both the Primary and Secondary units and save the complete output:
get system performance status
get system status
get system ha status
diagnose sys ha status
diagnose sys ha history read
diagnose debug crashlog read
diagnose sys ha checksum show
diagnose sys ha dump 5
diagnose sys ha dump-by group
  1. If synchronization must be restarted, first stop it:
execute ha synchronize stop

Then start synchronization on the backup unit first:

execute ha synchronize start

Recalculate the HA checksum:

diagnose sys ha checksum recalculate
  1. To connect from the Primary unit to a Secondary unit through the CLI, use its HA index and administrator account:
execute ha manage <Index-ID> <Admin-Username>
  1. Inspect the heartbeat interface and capture traffic between HA ports. Replace the placeholder with the heartbeat interface name:
diagnose hardware device nic <heartbeat interface>

Run a packet capture on the HA interface, replacing port_ha with the heartbeat interface:

diagnose sniffer packet port_ha "" 4 0 l

To capture heartbeat packets only, filter for EtherType 0x8890:

diagnose sniffer packet any 'ether proto 0x8890' 4 0 l

HA uses these EtherType values:

  • ha-eth-type: 8890 — standard NAT/Route mode heartbeat.
  • hc-eth-type: 8892 — Transparent mode heartbeat or session synchronization.
  • l2ep-eth-type: 8893 — HA configuration synchronization through the Layer 2 Endpoint.

Verify the configured HA EtherType parameters:

get system ha
show full sys ha | grep -f eth
  1. From both FortiGate units, collect the HA Event logs and System Event logs. Download them from the GUI, FortiAnalyzer, or the remote syslog server.

Verification

Confirm that complete hatalk or hasync debug output is generated, both units return the requested HA status and checksum data, and heartbeat traffic is visible on the configured HA interface. Compare the collected information and logs from both cluster members.

Rollback

Disable active debugging after data collection:

diagnose debug disable

Tags

No tags yet.

Community rating

— / 5 (0)

Discussion (0)

    No comments yet.