Technical Tip: How to break active-passive High Availability (HA) cluster between two FortiAuthenticator devices

Description

This article describes the steps required to safely break the High Availability (HA) configuration between two FortiAuthenticator units in an existing Active-Passive HA cluster.

Scope

FortiAuthenticator.

Solution

Prerequisites:

• Console access (VM console or physical) to both the primary and secondary devices.

• Administrative credentials.

• Temporary IP address.

Procedure:

Step 1: Access both devices.

Open the console session for both the primary and secondary FortiAuthenticator units.

Step 2: Disconnect the secondary unit.

Disconnect port1 from the secondary FortiAuthenticator. This prevents network conflicts while its configuration modification.

Step 3: Disable HA on the secondary unit.

On the secondary FortiAuthenticator console CLI, run the following commands:

config system ha
    set mode disable
end

Step 4: Assign a temporary IP address and default gateway.

Assign a temporary IP to port1 on the secondary unit so it can be accessed via the GUI. Ensure this temporary IP is reachable from the client machine.

Replace x.x.x.x/x with the appropriate IP and port.

config system interface
    edit port1
        set ip <x.x.x.x/x>
end

Configure default gateway:

Replace <interface_name> with the appropriate interface, and y.y.y.y with the appropriate IP and port.

config router static
    edit <>
        set device <interface_name>
        set dst 0.0.0.0/0
        set gateway y.y.y.y
end

Step 5: Reconnect and access the secondary GUI.

Reconnect port1 on the secondary unit. Then, open a web browser on the client machine and access the secondary unit’s GUI using the temporary IP address configured in step 4.

Step 6: Disable HA on the primary unit.

On the primary FortiAuthenticator, log in to the GUI and navigate to System -> Administration -> High Availability.

Select the 'Enable High Availability' toggle button to turn off HA mode on the primary unit.

Verification:

• Confirm that both units are operating independently.

• Verify that network access and authentication services are functioning as expected on each unit.

Notes:

• Disabling HA will remove synchronization between devices.

• Ensure system backups are taken before proceeding.

• Use caution when changing HA configurations in production environments.