After dual-system hot backup are configured on two USG5000, both device are in the master state.
Check the heartbeat interface status. On a firewall, ping the IP address of the peer heartbeat interface. The peer heartbeat interface is normal.
Check the switch configuration, especially the Ethernet channel configuration. A trunk link is configured. Check the VLAN number allowed by the trunk. This number is not changed, as a result, Laye-2 VRRP packets cannot be transferred.
Usually, this problem is caused by improper heartbeat cable connection.
In a cutover scenario, the customer changes the VLAN number of the switch and the IP address of the firewall. Then the dual-master problem occurs.
When you configure dual-system hot backup, check the switch configuration. Make sure that Layer-2 packets are allowed through.