Which two statements are true about an HA cluster? (Choose two answers)

A FortiGate High Availability (HA) cluster relies on monitoring and synchronization to ensure seamless failover. Link monitoring is a key mechanism where the cluster checks the status of designated interfaces. If a monitored interface on the primary unit goes down, whether due to a physical link loss or an administrative shutdown, it triggers a failover to the secondary unit.

Furthermore, to maintain stateful failover, the cluster continuously synchronizes dynamic data. This incremental synchronization includes runtime data such as the Forwarding Information Base (FIB) routing entries, session tables, DHCP leases, and IPsec Security Associations (SAs), ensuring the new primary unit can resume traffic processing with minimal interruption.

A. An HA cluster can have both in-band and out-of-band management interfaces configured and active simultaneously, providing flexible administrative access.

C. The default heartbeat management IP for the secondary unit is 169.254.0.2, but this is configurable using the ha-mgmt-interfaces command, so it is not a mandatory address.

1. Fortinet FortiOS 7.0.12 Administration Guide:

Page 2018, "Link monitoring and failover": "The cluster monitors each of the interfaces that you add to the monitordev list. If an interface on the primary unit fails, the cluster reorganizes and a new primary unit is selected." An administrative shutdown is considered an interface failure. This supports answer B.

Page 2000, "Information synchronized by the FGCP": A table lists the information synchronized between cluster units. It explicitly includes "Kernel routing tables (FIB)" and "IPsec security associations (SAs)". This supports answer D.

2. Fortinet FortiOS 7.0.12 High Availability Guide:

Page 93, "Out-of-band management": This section details the configuration of dedicated HA management interfaces (ha-mgmt-interfaces), which can be used alongside standard in-band management access enabled on other interfaces. This refutes option A.

Page 93, "Out-of-band management": The documentation shows how to set a custom IP address and gateway for the HA management interface, confirming that the IP address 169.254.0.2 is not mandatory. This refutes option C.