Troubleshooting HA status "Unknown" and "No route to host" when accessing the secondary FortiGate

An HA cluster can report the secondary member as out of sync with an "Unknown" status in the GUI. Attempts to access the secondary unit from the primary CLI fail because the HA management connection to 169.254.0.2 has no route: ``` execute ha manage 1 <user-name> ``` Expected error: ``` ssh: connect to host 169.254.0.2 port 22: No route to host ```

The issue can present with one or more of the following indicators: - The GUI displays the HA status as "Unknown". - The secondary member is out of sync and its cluster checksum contains only zeros. - The secondary may be absent from part of the cluster-selection history. - Traffic captures report 169.254.0.2 as unreachable. - `hatalk` and `hasync` debugging reports error 113, "No route to host". Check HA status: ``` get sys ha status ``` Example output: ``` Primary selected using: HA Health Status: OK Model: FortiGate-120G Mode: HA A-P Group Name: Hub1 Group ID: 0 Debug: 0 Cluster Uptime: 109 days 22:9:15 Cluster state change time: 2024-10-29 03:54:15 <2024/10/29 03:54:15> vcluster-1: FG120GTK00000001 is selected as the primary because its uptime is larger than peer member FG120GTK00000002. <2024/10/29 03:51:22> vcluster-1: FG120GTK00000001 is selected as the primary because it's the only member in the cluster. <2024/10/29 03:51:16> vcluster-1: FG120GTK00000001 is selected as the primary because SET_AS_SECONDARY flag is set on peer member FG120GTK00000002. ses_pickup: disable override: disable Configuration Status: FG120GTK00000001(updated 0 seconds ago): in-sync FG120GTK00000001 chksum dump: 03 0a 0f 9d d3 e8 02 63 10 3f 71 a1 ef 20 31 90 FG120GTK00000002(updated 1730208767 seconds ago): out-of-sync FG120GTK00000002 chksum dump: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ``` An ICMP capture can show: ``` filters=[host 169.254.0.1 or host 169.254.0.2] 2024-09-14 10:58:11.251632 vsys_ha out 169.254.0.1 -> 169.254.0.1: icmp: host 169.254.0.2 unreachable ``` Enable HA application debugging: ``` diag deb application hatalk -1 diag deb application hasync -1 diag deb en ``` Example debug output: ``` 2024-09-19 17:22:58 <hatalk> vcluster_1: ha_prio=1(secondary), state/chg_time/now=3(standby)/1726790186/1726791778 2024-09-19 17:22:59 <hasync:WARN> conn=0xd46a160 connect(169.254.0.1) failed: 113(No route to host) ```

FortiGate HA clusters, including VMware-hosted FortiGate deployments. The example is an active-passive (`HA A-P`) cluster using a FortiGate-120G.

FortiOS v7.2 and later. Permanent fixes are identified for FortiOS v7.2.11, v7.4.5, and v7.6.1.

HA heartbeat communication is not functioning over the selected HA or management port, preventing synchronization and connectivity through the HA link-local addresses. An "Unknown" HA status can also occur when the secondary runs a different firmware version or when the cluster is experiencing split brain. In VMware, blocked or unsupported heartbeat-interface MAC behavior can cause the same condition when MAC address spoofing is not enabled on the connected virtual switches.