In the utility's FGCP cluster protecting the control-center perimeter, the two FortiGate units continuously exchange configuration synchronization and status information over a link dedicated to that purpose, separate from the interfaces carrying substation and back-office traffic. What is this dedicated link used for?
Select an answer to reveal the explanation.
Short Explanation
Think of the heartbeat link as the two firewalls constantly checking each other's pulse. Over that dedicated connection they synchronize configuration and session state and confirm the other unit is still alive, which is exactly how your cluster knows the instant it needs to fail over.
Full Explanation
FGCP high availability requires one or more dedicated heartbeat interfaces between cluster members, carrying HA packets that synchronize configuration changes, session tables where applicable, and periodic status signals confirming each unit is healthy. When heartbeat packets stop arriving from a member, the surviving unit interprets that as a failure and triggers failover according to the cluster's configured priority and monitoring settings. That dedicated purpose is why the heartbeat link is kept separate from interfaces carrying substation and back-office traffic — mixing the two would let ordinary traffic congestion masquerade as a cluster failure. The link is not meant to carry production traffic, nor does it distribute DHCP leases to field devices, which is a function of an interface's own DHCP server or relay configuration. It also is not used to reach the internet for updates; firmware and signature updates are pulled through the unit's normal WAN or FortiGuard-reachable interface. To verify heartbeat health, check the HA monitor for both members reporting synchronized status and confirm heartbeat interfaces show as up on both units.