Skip to main content
RobinR06
RobinR06
New Member
July 13, 2023
Question

Fortigate 100f Active-Passive HA not working as expected

  • July 13, 2023
  • 5 replies
  • 10020 views

Hello everyone,

 

we have recently bought two Fortigate 100f Firewall and set them Active Passive HA mode.

One would expect 1 Firewall to be active and 1 to passive, as the name suggests. But it looks like both are active?

The thing is, if I attach a Layer2 Switch with an IP address to FW1, it works and I can ping it. Just like expected.
If I connect the same Switch to FW2 only, it works and I can ping it. Strange, because FW1 is active?
If I connect the same Switch to FW1 and FW2 (for redundancy) my networks goes down, my laptop hangs and I cannot ping a thing. So looks like a double IP address issue. 

So what am i doing wrong? Or do I not get how Active-Passive is suppose to work?thumbnail_image.png

5 replies

Umesh
Umesh
Explorer II
July 13, 2023

Hi,

 

Can you confirm what layer 2 switches you are using stack switch or separate switch.

side by side can you confirm those interfaces are getting monitered. 

RobinR06
RobinR06Author
New Member
July 13, 2023

The two swtiches are seperate switches.
One is 10.10.10.5 and the other one is 10.10.10.6
Yes, all interfaces are monitored

 

srajeswaran
Staff
srajeswaran
Staff
July 13, 2023

How are switch1 and Switch 2 connected?

From where are you testing/initiating traffic?

When you disconnect cable from the active node, is there a failover due to monitored interface going down?

 

 

RobinR06
RobinR06Author
New Member
July 13, 2023

We have FW1 and FW2 connected to eachother with UTP via HA1 and HA2.
We have FW1 and FW2 connected to a simple 5Port Switch for Internet with UTP via WAN1
We have FW1 connected to Switch 1 with UTP via port 5 and to Switch 2 with UTP via port6

 

As soon as I plug in FW2 to Switch 1 with UTP via port 5 and to Switch 2 with UTP via port6 everything goes down and starts flapping.

Naamloos.jpg

RobinR06
RobinR06Author
New Member
July 13, 2023

And the strange thing is (in my opinion) it doesnt matter to which FW I connect the Switch. They will both be available and connected. But as soon as I connect 1 Switch bot both FW's it's goes wrong

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
July 13, 2023

Before you hook up one switch to both HAed FGTs, what do you see in "get sys ha status"? Please share us the key parts of the output.

<edit>I mean on both FGTs.</edit>

 

Toshi

RobinR06
RobinR06Author
New Member
July 14, 2023

SAB-IJS-FW-HA-01 # get sys ha status
HA Health Status: OK
Model: FortiGate-100F
Mode: HA A-P
Group Name: SAB-OT-HA
Group ID: 0
Debug: 0
Cluster Uptime: 106 days 5:7:36
Cluster state change time: 2023-07-12 13:52:45
Primary selected using:
<2023/07/12 13:52:45> vcluster-1: FG100FTK22034583 is selected as the primary because EXE_FAIL_OVER flag is set on peer member FG100FTK22034641.
<2023/07/12 13:52:45> vcluster-1: FG100FTK22034583 is selected as the primary because it's the only member in the cluster.
<2023/07/12 13:36:54> vcluster-1: FG100FTK22034583 is selected as the primary because EXE_FAIL_OVER flag is set on peer member FG100FTK22034641.
<2023/07/12 13:36:53> vcluster-1: FG100FTK22034583 is selected as the primary because it's the only member in the cluster.
ses_pickup: enable, ses_pickup_delay=disable
override: disable

Primary : SAB-IJS-FW-HA-01, FG100FTK22034583, HA cluster index = 1
Secondary : SAB-IJS-FW-HA-02, FG100FTK22034641, HA cluster index = 0
number of vcluster: 1
vcluster 1: work 169.254.0.2
Primary: FG100FTK22034583, HA operating index = 0
Secondary: FG100FTK22034641, HA operating index = 1

----------

SAB-IJS-FW-HA-02 # get sys ha status
HA Health Status: OK
Model: FortiGate-100F
Mode: HA A-P
Group Name: SAB-OT-HA
Group ID: 0
Debug: 0
Cluster Uptime: 106 days 5:15:23
Cluster state change time: 2023-07-12 13:36:55
Primary selected using:
<2023/07/12 13:36:55> vcluster-1: FG100FTK22034583 is selected as the primary because EXE_FAIL_OVER flag is set on peer member FG100FTK22034641.
<2023/07/12 13:36:55> vcluster-1: FG100FTK22034641 is selected as the primary because it's the only member in the cluster.
<2023/07/12 13:36:51> vcluster-1: FG100FTK22034583 is selected as the primary because EXE_FAIL_OVER flag is set on peer member FG100FTK22034641.
<2023/07/12 13:36:39> vcluster-1: FG100FTK22034641 is selected as the primary because it's the only member in the cluster.
ses_pickup: enable, ses_pickup_delay=disable
override: disable

Secondary : SAB-IJS-FW-HA-02, FG100FTK22034641, HA cluster index = 0
Primary : SAB-IJS-FW-HA-01, FG100FTK22034583, HA cluster index = 1
number of vcluster: 1
vcluster 1: standby 169.254.0.2
Secondary: FG100FTK22034641, HA operating index = 1
Primary: FG100FTK22034583, HA operating index = 0

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
July 14, 2023

You probably fogot to unset forced failover.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-HA-does-not-failover-even-if-the-Remote-Link/ta-p/253237

But otherwise it looks normal HA-wise.
Just unset the failover, then try hooking up one switch to port5 on both FGTs then quickly check this HA status again.
Looks like you hid "Configuration Status:" part as well but before testing again, make sure both are "in-sync" each other.

 

Toshi

Christian_89
Christian_89
Esteemed Contributor III
July 14, 2023

In an Active-Passive High Availability (HA) setup with FortiGate firewalls, only one firewall should be active at any given time, while the other remains passive, ready to take over in case of a failure. It seems like there may be a misconfiguration or issue with your HA setup. Here are a few things to consider and troubleshoot:

1. HA Configuration: Verify that you have correctly configured the firewalls for HA. Ensure that you have designated one firewall as the primary (active) unit and the other as the secondary (passive) unit. Check that the HA heartbeat interface is properly configured and connected between the firewalls.

2. HA Synchronization: Confirm that the HA synchronization is working correctly. The active unit should synchronize its configuration, policies, and session information to the passive unit. Check the HA synchronization status and logs to ensure there are no errors or discrepancies.

3. Interface Configuration: Review the interface configurations on both firewalls. Ensure that the interfaces connected to your Layer 2 switch are properly configured and assigned to the correct zones or VLANs. Verify that the interface states and link status are correct.

4. IP Address Conflict: It seems like there might be an IP address conflict when you connect both firewalls to the switch. Check the IP address assignments for the interfaces on each firewall. Ensure that there are no duplicate IP addresses or overlapping subnets. Each firewall should have unique IP addresses assigned to its interfaces.

5. Switch Configuration: Review the configuration of the Layer 2 switch. Ensure that it is not causing any issues with the firewall connectivity or creating a loop in the network. Check for any spanning tree protocol misconfigurations or loop prevention mechanisms that could be affecting the network.

6. Log Analysis: Check the firewall logs for any error messages, warnings, or indications of a problem. Look for any HA-related messages or network connectivity issues that could provide insight into the cause of the problem.

If you have gone through these troubleshooting steps and the issue persists, it is recommended to reach out to Fortinet support or consult with a network specialist who can further analyze your HA configuration and assist in resolving the problem.

RobinR06
RobinR06Author
New Member
August 23, 2023

Thanks all for the help. I figured out the problem is not really in HA, but in the Hardware Switch.
We have configured a Hardware Switch with ports 5, 6, 7 and 8.
We thought Active-Passive means 1 firewall works, and 1 is passive. But If we pull out 1 device on the active firewall, the port on the secondary firewall becomes active. So the passive firewall port takes over.

And if we put a device on both firewalls, the whole setup reacts like one big hardware switch (instead of active/passive) and we get a loop as if it is a normal switch.

JesperAP
JesperAP
New Member
March 19, 2024

Hi Robin,

 

I am currently having the same issue I think,

 

Can you explain how you fixed it with the hardware switches?

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
March 19, 2024

@JesperAPMost unlikely your network set up with two FGTs and external switches as well as hardswitch setup is the same with the original poster's.
Please start a new thread and explain your HA problem in detail hopefully with a diagram so that anyone can contribute to resolve your issue.

 

Toshi

Terms & ConditionsCookie settingsAccessibility statement