Rebooting secondary Fortigate in A/P pair causes traffic loss on 7.6.6

Question ❓

Hi I'm investigation a strange issue that I'm already having for a couple of months.

We have two Fortigates 601F in HA A/P.

We are having traffic issues if reboot the secondary firewall without doing a failover or if we reboot the primary firewall and force a failover.

First we thought the issues is because we had intra-vlan-blocking enabled on the FortiLink vlan's. If we turned that off the failover was working "fine".

I have found out now that we also have traffic issue if we just reboot the secondary firewall in the HA pair. After doing some packet captures/port mirroring, it looks like the secondary Fortigate sends out an ARP announcement for all the FortiLink vlan's from it's FortiLink ports. (X1 and X2 in LACP Active to MCLAG core)

So even without doing a failover but just rebooting the secondary firewall. The secondary firewall sends out an ARP annoucement 5 seconds before it reboots. It's not really weird that the MAC address table on the core switches don't like this.

In the release notes from 7.4.9 and 7.6.5 I see these two resolved bugs:

1187401 Unexpected behavior in the system occurs when an HA unit is restarted.

1191128 Intermittent traffic disruption occurs when the secondary FortiGate is rebooting in HA mode.

We are running 7.6.6 so this bugs should be resolved.

We have already a support ticket open for 4 months now without any progress. We had this issue on 7.4.8/7.4.9 and now on 7.6.6

Is anyone else also having this issue on 601F on 7.6.6?

Posted Mar 10, 2026, 11:33 AM UTC

413
Loading comments…