Configuring Floating IP Support in FortiADC High Availability

Description

How to configure and troubleshoot floating IP addresses in FortiADC High Availability (HA) deployments.

Scope

FortiADC.

Solution

A floating IP address is an IP address that can move between nodes in an HA cluster, allowing services to remain reachable during a failover.

In FortiADC, floating IP support depends on the HA operating mode and the interface configuration. Although the floating IP option may be configurable on an interface, this does not guarantee that the address will be reachable or registered in the FortiADC IP list.

Configuring network interfaces

Configuration

1. Configure the floating IP address

To enable floating IP support on an interface, configure the floating IP parameter in the FortiADC CLI.

config system interface
    edit port1
        set floating enable
        set floating-ip 10.47.20.78
    next
end

Replace port1 and 10.47.20.78 with the appropriate interface and floating IP address for your environment.

Note:

The availability and behavior of floating IP addresses depend on the FortiADC HA mode and the software version in use.

2. Verify the HA mode

 Check the current HA configuration:

get sys ha-status

In the example below, the device is operating in Active-Passive mode:

Group ID: 10
Mode: active-passive
State: Primary

Check the interface configuration:

get sys interface port1

Confirm that the interface has the expected IP address and that floating IP support is enabled.

Example configuration parameters:

type: physical
mode: static
ip: 10.47.20.78/20
floating: enable
floating-ip: 10.47.20.78

Verify the actual field names and values against the output provided by your FortiADC software version.

Troubleshooting

Symptom

The configured floating IP address does not respond to ping requests.

1. Test connectivity

From the FortiADC CLI, test the floating IP address:

exec ping 10.47.20.78

Example output:

PING 10.47.20.78 (10.47.20.78): 56 data bytes
Timeout ...
Timeout ...
Timeout ...
Timeout ...

--- 10.47.20.78 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

 2. Check the FortiADC IP list:

The following CLI output shows that the floating IP address is not in the FortiADC IP list.

(P) FortiADC-1 # diagnose netlink ip list
IP=127.0.0.1 MASK=255.255.255.0 index=1 devname=lo
IP=127.129.1.1 MASK=255.255.255.255 index=1 devname=lo
IP=10.47.20.76 MASK=255.255.240.0 index=4 devname=port1
IP=169.254.29.1 MASK=255.255.0.0 index=19 devname=haport0

Solution:

If a configured floating IP address is not reachable:

1. Verify the current HA mode and status.

2. Confirm that floating IP support is enabled on the intended interface.

3. Verify the configured floating IP address.

4. Check whether the address appears in the output of diagnose netlink ip list.

5. Test connectivity again after confirming the HA configuration.
   
   

FortiADC-1 # get sys ha-status
Group ID: 10
Mode: active-active-vrrp
State: VRRP (Active)

FortiADC-1 # get sys interface port1
type : physical
dedicate-to-mgmt : disable
mode : static
vdom : root
redundant-master :
ip : 10.47.20.76/20
ip6 : ::/0
allowaccess : https ping ssh http telnet
mtu : 1500
speed : auto
status : up
retrieve_physical_hwaddr : disable
mac-addr : 00:70:72:65:1d:01
flow-sniffer : disable
wccp : disable
trust-ip : disable
secondary-ip : disable
ha-node-secondary-ip : disable
traffic-group :
floating : enable
floating-ip : 10.47.20.78
floating-ip6 : ::
recv-seg-offload-override : disable
send-seg-offload-override : disable

FortiADC-1 # execute ping 10.47.20.78
PING 10.47.20.78 (10.47.20.78): 56 data bytes
64 bytes from 10.47.20.78: icmp_seq=1 ttl=64 time=0.1 ms
64 bytes from 10.47.20.78: icmp_seq=2 ttl=64 time=0.0 ms
64 bytes from 10.47.20.78: icmp_seq=3 ttl=64 time=0.0 ms
64 bytes from 10.47.20.78: icmp_seq=4 ttl=64 time=0.0 ms
64 bytes from 10.47.20.78: icmp_seq=5 ttl=64 time=0.0 ms
--- 10.47.20.78 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.0/0.0/0.1 ms

FortiADC-1 # diagnose netlink ip list
IP=127.0.0.1 MASK=255.255.255.0 index=1 devname=lo
IP=127.129.1.1 MASK=255.255.255.255 index=1 devname=lo
IP=10.47.20.76 MASK=255.255.240.0 index=4 devname=port1
IP=10.47.20.78 MASK=255.255.255.255 index=4 devname=port1
IP=169.254.29.1 MASK=255.255.0.0 index=19 devname=haport0

Related document:
Advantages of HA Active/Active-VRRP