Community

banshee is under active development: collectors will keep changing, and a version you publish will likely need adjustments. For stable use, wait for version 1.0.0.

Network

banshee/network-collection/network/fortinet/snmp/

ha

The high-availability cluster of a FortiGate by SNMP: its mode, its members, their configuration sync, and a failover.

  • network
  • snmp
  • fortinet
  • fortigate
  • fortios
  • firewall
  • ha
  • cluster

by banshee1 installation2 versions

v2Latest

Published on October 28, 2026. One naming convention across collections; documentation completed.

High-availability cluster of a FortiGate, by SNMP

Returns, for a FortiGate cluster (FGCP), its mode, the number of its members, whether each member has its configuration in sync, and which member is primary. Four watches are offered: a member missing from the cluster, a configuration out of sync, a failover, and a member missing by name.

Versions

FortiOS 5, 6 and 7, which serve these objects alike. It stays at the common level of fortinet/.

How it works

The collector reads fgHaSystemMode and fgHaStatsTable (FORTINET-FORTIGATE-MIB):

  • The mode is active-passive or active-active. A FortiGate that is not in a cluster (standalone) stops the collector as misconfigured: there is no cluster to watch.
  • A member is named by its host name (fgHaStatsHostname), or by its serial number when it has none.
  • The sync is fgHaStatsSyncStatus in words: synchronized or unsynchronized. A configuration change leaves the members unsynchronized for a moment: "Configuration out of sync" is critical when it lasts 3 runs.
  • The members count the rows of the table: "Cluster member missing" is critical below 2.
  • The primary is the member whose serial number is fgHaStatsMasterSerial, the primary at the last sync, by its host name. "Failover" raises when it is another member than the one named on the probe.

The collector only reads: SNMP sends nothing but reads.

Prerequisites

  • SNMP enabled on the FortiGate, reachable from the poller (UDP 161), a community or a user restricted to the poller.
  • Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

Outputs

NameLabelUnitPer instance
modeCluster mode—no
membersMembers—no
primaryPrimary member—no
syncConfiguration sync—yes, per member

Watches

NameTitleKindDefaultsChecked by default
member-lostCluster member missingbelow a threshold, on memberscritical below 2yes
out-of-syncConfiguration out of syncstate to avoid, on synccritical on unsynchronized, for 3 runsyes
primaryFailoverexpected value, on primaryno member given: it raises nothing until the expected primary is set on the probeno
missingMember missingexpected instances, on syncno member named: it raises nothing until names are set on the probeno

Limits

  • The primary is the one of the last sync attempt, as FortiOS records it: a failover shows once the cluster has synchronized since.
  • A cluster of three or four members: set "Cluster member missing" to the number expected.
  • Whether a member that left the cluster leaves the table at once, or after a delay, is not verified here without a cluster.