Technical Tip: How to Manage individual cluster units via CLI command

Description

This article explains how to manage individual cluster units with the CLI command 'execute ha manage'.

Scope

FortiGate

Solution

The following procedure describes how to use SSH to log into the primary unit CLI and, from there, to use the execute ha manage command to connect to the CLI of any other unit in the cluster.

The procedure is very similar if telnet is used or the GUI dashboard CLI console.

Use the execute ha manage command from the CLI of any cluster unit to log into the CLI of another cluster unit. Use this command from the CLI of the primary unit to log into the CLI of a subordinate unit.

However, if the user is logged into a subordinate unit CLI, use this command to log into the primary unit CLI, or the CLI of another subordinate unit. Using SSH or telnet, or the GUI dashboard CLI console can only log into the primary unit CLI.

Using a direct console connection permits to log into any cluster unit. In both cases, use 'execute ha manage' to connect to the CLI of other cluster units.

Use SSH to connect to the cluster and log into the primary unit CLI. Connect to any cluster interface configured for SSH administrative access to log into the cluster.

Enter the following command followed by a space and type a question mark (' ?').

execute ha manage

The CLI displays a list of all the subordinate units in the cluster. Each cluster unit is numbered, starting at 1. The information displayed for each cluster unit includes the unit serial number and the host name of the unit.

Complete the command with the number of the subordinate unit to log into. For example, to log into subordinate unit 1, enter the following command:

execute ha manage 1 <admin-account>

Replace <admin-account> with an administrator account and press Enter to log into the CLI of the selected subordinate unit. If this subordinate unit has a different host name, the CLI prompt shows the HA unit's host name.

Use CLI commands to manage this subordinate unit.  In some old FortiOS versions, the command 'execute ha manage 1' would be sufficient and the administrator account had to be typed in a further step.

If changes to the configuration of any cluster unit are processed (primary or subordinate unit) these changes are synchronized to all cluster units.

Use the 'execute ha manage' command to connect to any other cluster unit (including the primary unit). It is also use the 'exit' command to return to the primary unit CLI.