Technical Tip: Unable to re-build FortiNAC High Availability 'WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!'

1. Break High Availability from GUI by clearing the VIP (if it is in place) and secondary Node Information:
   
   

2. Factory reset the Secondary Node (it will delete all settings and data on the node this is executed at):

execute factoryreset all-setting

3. Rebuild the High Availability and the following error is displayed:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
SHA256:gUhJsXoJ4kOwa0H7O6VLygp0yh45o5nMMl85ZXPBp4o.
Please contact your system administrator.
Add correct host key in /home/root/.ssh/known_hosts to get rid of this message.
Offending ED25519 key in /home/root/.ssh/known_hosts:6
Host key for 192.168.40.121 has changed and you have requested strict checking.
Host key verification failed.
SSH key verification failed from 192.168.40.120 to 192.168.40.121. Verify that the SSH key for 192.168.40.120 is configured on 192.168.40.121.

Solution:

On FortiNAC v7.2.6, v7.2.7:

execute ssh-known-hosts remove-host ha <secondary-NAC-IP>
execute ssh-known-hosts add ha admin <secondary-NAC-IP>
execute ssh-known-hosts show ha

On FortiNAC version 7.4.0 and above:

execute ssh-known-hosts show current-user <secondary-NAC-IP>

execute ssh-known-hosts remove-host current-user <secondary-NAC-IP>

Note: On FortiNAC v7.2.5 and lower, change the IP of the Secondary Node or upgrade to FortiNAC v7.2.6 or greater.

On FortiNAC v9.4.8 (CentOS)  and lower:

Follow the solution below when a new FortiNAC appliance is being deployed and the following error appears when trying to save HA settings on the Primary NAC Appliance GUI:

"Command Failed. Issuing the run command on the Primary Server 192.168.44.245. Ping of the Secondary Server 192.168.44.246 succeeded. Error: Authentication Failed. Host key verification failed. Configuration Errors occurred".

Notes:

• This error means the FortiNAC server SSH Key has not been added yet to the Known Hosts file for any of the appliances (Primary and Secondary).

Step 1: Check for SSH keys entries currently added for the IP address on each FortiNAC appliance in the known_hosts file:

cat /root/.ssh/known_hosts

Step 2: Manually add the Secondary FortiNAC SSH key missing in the Primary FortiNAC Known Hosts list:

ssh userid@secondaryNAC-IP

Notes: When the system prompt if want to continue, type "yes".

Step 3: Manually add the Primary FortiNAC SSH key missing in the Secondary FortiNAC Known Hosts list:

ssh userid@primaryNAC-IP

Notes: When the system prompts the user to confirm whether to continue, enter 'yes'.

Step 4: Re-apply the HA settings from the Primary FortiNAC GUI by navigating to System -> Settings -> System Management -> High Availability -> Save Settings.