During a firmware upgrade on an active-active HA cluster, the uninterruptible upgrade feature is enabled by default to minimize downtime. This process involves upgrading the secondary unit first, which then reboots. A failover occurs, making the newly upgraded secondary unit the primary. During this transition, the new primary unit handles all traffic, meaning that active-active load balancing is temporarily suspended. The old primary (now the new secondary) is then upgraded. This sequential process ensures service continuity but relies on a single unit for a short period.

A. The firmware is uploaded only to the primary unit, which then automatically synchronizes and upgrades the secondary units.

B. All FortiGate devices in the cluster are rebooted, but sequentially, not simultaneously, to maintain network connectivity.

1. FortiOS 7.0.0 High Availability Guide, "Upgrading the cluster firmware" section. It states, "By default, uninterruptible-upgrade is enabled." and "You upload the firmware image to the primary FortiGate and the primary FortiGate upgrades the firmware of all the cluster members."

2. FortiOS 7.0.0 High Availability Guide, "HA uninterruptible upgrade" section. The description of the process confirms that a failover occurs and one unit handles traffic while the other is upgraded, thus suspending load balancing.