Staff

Troubleshooting Tip: Fixing ping failures between FortiGate HA management ports

Forum|Forum|1 year ago
November 17, 2024
0 replies
2240 views

Description

This article describes how to troubleshoot and resolve ping failures between FortiGate HA management ports, ensuring proper communication and connectivity in a High Availability setup.

Scope

FortiOS.

Solution

FortiGate is set up as Active-Passive where a dedicated OOB mgmt interface is configured.

In this example, one FortiGate's (FGT1) mgmt interface IP is 10.110.100.1, whereas FGT2's mgmt interface IP is 10.110.100.2.

Here, VLAN 1000 is the dedicated mgmt interface.

On the Primary FortiGate1:

config system interface
    edit "vlan_1000"
        set ip 10.110.100.1 255.255.255.0
        set allowaccess ping https ssh
        set alias "mgmt"
        set role lan
        set snmp-index 46
        set interface "CORE-SW-LINK"
        set vlanid 1000
next
end

On Secondary FortiGate2:

config system interface

    edit "vlan_1000"
        set ip 10.110.100.2 255.255.255.0
        set allowaccess ping https ssh
        set alias "mgmt"
        set role lan
        set snmp-index 46
        set interface "CORE-SW-LINK"
        set vlanid 1000
    next
end

The ping from the Primary FortiGate (10.110.100.1) to 10.110.100.2 does not work.

FORTIGATE-MASTER # execute ping 10.110.100.2
PING 10.110.100.2 (10.110.100.2): 56 data bytes

--- 10.110.100.2 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

To enable ping functionality using the dedicated management interface IP, access the hidden management VDOM.

FORTIGATE-MASTER # execute enter
<name> vdom name
root
vsys_hamgmt

FORTIGATE-MASTER # execute enter vsys_hamgmt
current vdom=vsys_hamgmt:3

Now try to ping again, and it works fine.

FORTIGATE-MASTER # execute ping 10.110.100.2
PING 10.110.100.2 (10.110.100.2): 56 data bytes
64 bytes from 10.110.100.2: icmp_seq=0 ttl=255 time=0.1 ms
64 bytes from 10.110.100.2: icmp_seq=1 ttl=255 time=0.0 ms
64 bytes from 10.110.100.2: icmp_seq=2 ttl=255 time=0.0 ms
64 bytes from 10.110.100.2: icmp_seq=3 ttl=255 time=0.0 ms
64 bytes from 10.110.100.2: icmp_seq=4 ttl=255 time=0.0 ms

--- 10.110.100.2 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 0.0/0.0/0.1 ms

The secondary FortiGate management IP is now reachable via ping.

For testing communication through the dedicated HA management IP, the hidden management VDOM must be accessed to initiate traffic from the FortiGate.

Related articles:

Technical Tip: HA Reserved Management Interface's hidden VDOM (vsys_hamgmt VDOM)

Technical Tip: Default route via HA reserved management Interface not visible on route table

Technical Tip: Unable to select interface when configuring HA Reserved Management Interface