|
When a FortiNAC secondary server has been redeployed or has generated new Host SSH keys, FortiNAC primary will still keep the previous fingerprint and report the following error:
High Availability Configuration FAILURE<br>17:44:29 08/05/2025 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
17:44:29 08/05/2025 @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
17:44:29 08/05/2025 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
17:44:29 08/05/2025 IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
17:44:29 08/05/2025 Someone could be eavesdropping on you right now (man-in-the-middle attack)!
17:44:29 08/05/2025 It is also possible that a host key has just been changed.
17:44:29 08/05/2025 The fingerprint for the ED25519 key sent by the remote host is
17:44:29 08/05/2025 SHA256:XXXX/XXX/XXXXXX/XXXXX.
17:44:29 08/05/2025 Please contact your system administrator.
17:44:29 08/05/2025 Add correct host key in /home/root/.ssh/known_hosts to get rid of this message.
17:44:29 08/05/2025 Offending ED25519 key in /home/root/.ssh/known_hosts:9
17:44:29 08/05/2025 Host key for 10.10.10.5 has changed and you have requested strict checking.
17:44:29 08/05/2025 Host key verification failed.
17:44:29 08/05/2025 SSH key verification failed from 10.10.10.6 to 10.10.10.5. Verify that the SSH key for 10.10.10.6 is configured on 10.10.10.5.
A similar error will appear on the GUI when attempting to apply the HA config.
In this example, the secondary IP is 10.10.10.5.
First, identify the list of known keys in the Primary CLI:
naclab1 # execute ssh-known-hosts show ha
.
.
naclab2,naclab2.forti.lab,10.10.10.5 ssh-rsa XXXXXXX
naclab2,naclab2.forti.lab,10.10.10.5 ecdsa-sha2-nistp256 XXXXXXX
naclab2,naclab2.forti.lab,10.10.10.5 ssh-ed25519 XXXXXXX root@fortinac
.
.
Remove the SSH known host entries for 10.10.10.5 (secondary) in the Primary CLI:
naclab1 # execute ssh-known-hosts remove-host ha 10.10.10.5
# Host 10.10.10.5 found: line 7
# Host 10.10.10.5 found: line 8
# Host 10.10.10.5 found: line 9
After this step, submit the HA configuration through the GUI to establish High Availability, and for the Primary to update the new SSH key fingerprint.
Related document:
High Availability (FortiNAC-OS)
|
