Skip to main content
marcin2k
marcin2k
New Member
December 15, 2016
Question

Issue with setting up two Firewall Fortigate 300C clusters on same LAN

  • December 15, 2016
  • 2 replies
  • 5689 views

We have 2 firewall clusters consisting of fortigate 300C models with internal interface on both to the same local network (172.1.0.0/24). Each cluster has dedicated connections for clustering control lines.

 

Cluster 1 interface IP: 172.1.80.200/24

Cluster 2 interface IP: 172.1.88.200/24

 

This internal IP address is used to as well manage the firewall.

 

When both clusters are UP then only Cluster 2 interface is not stable. Ping frequently times out to cluster 2 IP. When Cluster 1 is shutdown then Cluster 2 has no issue. Behaviour is as if there was an IP conflict but there is none.

 

Cluster 2 was loaded by taking the configurations backups from Cluster 1 and modifying some parameters such as interface IPs.

 

Any idea why this setup does not work or any hints what to check? There are no IP conflicts in the design.

 

Thanks

    2 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    December 15, 2016

    Have you tried sniffing on the cluster1 side when you're pinging the cluster2 IP? Assuming nothing is there. Then probably you need to use wireshark or something to sniff on the line into cluster2, means at the switch, to get a clue.

    MikePruett
    MikePruett
    New Member
    December 15, 2016

    Are these devices in production? What level of "downtime" are you able to create with these things live?

     

    I would try building the HA from scratch again and then just copy and pasting firewall objects, policies, etc

    marcin2k
    marcin2kAuthor
    New Member
    December 22, 2016

    After troubleshooting and reading forums I found the solution. Both firewalls had the default group-id set for HA.

     

    When you put two firewall clusters on the same LAN you need to make sure each cluster uses unique group-id.

     

    To change:

    config system ha

       set group-id <integer>

    end

    Ralph1973
    Ralph1973
    New Member
    December 30, 2016

    I think you use the same (default) group id on the ha settings, this creates a conflict. Create an unique group id for each cluster.

     

    Kind regards,

    Ralph Willemsen

    Arnhem, Netherlands

    Terms & ConditionsAccessibility statement