Skip to main content
Prometheus
Prometheus
New Member
May 8, 2018
Question

Devices unreachable after setting active-active

  • May 8, 2018
  • 1 reply
  • 5151 views

Hi,

 

I have two FortiADC's running the latest firmware 5.0.1. I setup both devices with default values and after this initial setup I configured active-active on them. After the active-active setting the GUI is unreachable and the devices cannot be pinged. Checking using putty and the console cable I found out that the HA config is working fine the something in the network got messed-up. The device ant even ping itsself. 

 

I tried to view whats in the IPtables routing table but I was unable to list it. Changing the devices IP address (hoping it would reregister) did not have any effect. When you breakup the HA to standalone the devices resolve to normal and function again. Active-Passive seems to work as well.

 

Anyone got some ideas of how to deal with this? I already created a ticket but still though it to be wise to also ask the question here.

    1 reply

    Prometheus
    PrometheusAuthor
    New Member
    May 9, 2018

    Ok here is what I did wrong, and I found out using help from Fortinet. I put the IP on the interface which doesnt work anymore after Active-Active is setup. After Active-Active setup you must remove the IP from the interface and on each device create a management IP (each device diffrent IP).

    boneyard
    boneyard
    Valued Contributor
    May 19, 2018

    Thanks for reporting back Prometheus. Are you using Active-Active or Active-Active-VRRP? with Active-Active all documentation points to different IPs on the FortiADCs, so how is that possible if you can't use Interface IPs?

    Prometheus
    PrometheusAuthor
    New Member
    May 25, 2018

    Hi Boneyard,

     

    In the ADC from the GUI you go to Network > Interface, and here you can give up what the IP address of each port should be. But you have to leave this untouched, there is an specific setting for management IP. You can say management port is port1 and management IP is x.x.x.x then management is only possible on that specific port and IP but you can still fully use port1 for other functionalities.

     

    So the management IP is more of a virtual IP on top of the selected port.

    Terms & ConditionsAccessibility statement