NSE7 Troubleshooting and Diagnostics Practice Question
A network administrator is troubleshooting a FortiGate HA cluster in active-passive mode. The administrator notices that the secondary unit is not receiving heartbeat packets from the primary unit, and the cluster has split. The administrator runs 'diagnose sys ha status' on both units and sees that the primary unit shows the secondary as 'not connected', while the secondary unit shows the primary as 'not connected'. The administrator verifies that the heartbeat interfaces are correctly configured and physically connected. What is the MOST likely cause of the split?
⚠ Common exam trap
The trap here is focusing solely on FortiGate configuration and overlooking the network infrastructure, such as switch VLAN settings, which can silently drop heartbeat packets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The heartbeat packets are being dropped by an intermediate switch due to a native VLAN mismatch.
The most likely cause is that heartbeat packets are being dropped by an intermediate switch due to a native VLAN mismatch. When the FortiGate heartbeat interfaces are connected through a switch, the switch must properly forward the heartbeat traffic. A native VLAN mismatch can cause untagged packets to be dropped or sent to the wrong VLAN, preventing heartbeats from reaching the peer. This leads to both units losing communication and forming separate clusters.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The primary unit is overloaded and cannot send heartbeat packets.
Why it's wrong here
While an overloaded primary unit could delay heartbeat packets, it is unlikely to cause a complete cessation of heartbeats. The primary unit would still attempt to send heartbeats unless it is completely unresponsive. The scenario does not indicate high CPU or memory usage. Moreover, the secondary unit also shows the primary as not connected, suggesting a bidirectional communication failure, which is more consistent with a network or configuration issue than overload.
- ✗
The heartbeat interfaces are configured with different VLAN IDs on each unit.
Why it's wrong here
If the heartbeat interfaces had mismatched VLAN IDs, they would not be able to communicate, causing a split. However, the administrator verified that the heartbeat interfaces are correctly configured, which includes VLAN settings. Therefore, this is unlikely to be the cause. The issue is more likely related to a configuration mismatch that prevents heartbeats from being processed, such as differing HA priorities or group IDs, but the scenario specifies that the interfaces are correctly configured, so VLAN mismatch is not the most likely cause.
- ✗
The HA group ID is different on the two units, preventing them from forming a cluster.
Why it's wrong here
A mismatched HA group ID would prevent the units from forming a cluster at all, not just cause a split. If the group IDs were different, the units would not recognize each other as part of the same cluster, and the cluster would not form. In this scenario, the cluster was previously formed and then split, so the group ID was likely correct. Therefore, this is not the most likely cause.
- ✓
The heartbeat packets are being dropped by an intermediate switch due to a native VLAN mismatch.
Why this is correct
In HA, heartbeat packets are typically sent as untagged or with a specific VLAN. If the heartbeat interfaces are connected through a switch, a native VLAN mismatch on the switch ports can cause untagged heartbeat packets to be dropped or misdirected. This would result in both units showing each other as not connected, leading to a split. Since the administrator verified the FortiGate interfaces are correctly configured, the issue likely lies in the network infrastructure, such as a native VLAN mismatch on the switch.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.