accidentally rewrote the interface

[Dubos]

I was setting up SNMP and it was written in the instructions that "if you have a HA cluster, then you need to reset the interface" but I indicated the one that was connected. And the second device from the cluster is unavailable because it is Active-Passive. (Fortigate 600D-LENC, firmware version 5.4.0)
How do I regain access to the device?
If I connect via COM port, what should I write?
Should I write the same way as when I replaced it, just specify the previous address?

[Debbie_FTNT]

Hey Dubos,

I would suggest you connect via console, and then navigate to the interface you accidentally reset (I don't know what settings exactly you removed from it) then set the following:

#config system interface

#set mode static/dhcp <- whatever is appropriate
#set ip <x.x.x.x a.a.a.a> <- if mode is static

#show

-> is allowaccess configured with ping/ssh/https?
-> if not:
#set allowaccess ping ssh https
#end

Then check your routing:
#config router static
#show
-> make sure the default route or a route to your management subnet is present and correct
-> if not, configure it:
#config router static
#edit 0
#set gateway x.x.x.x
#set device <interface from above>
#set dst <default or mgmt subnet>
#end

With routing and the interface in place, you should have access to GUI again to reconfigure what else you might need.

[Dubos]

Thank you very much. I'll try to do it.
For greater clarity of the situation, here is what I entered last:

# config system ha
set ha-mgmt-status enable
set ha-mgmt-interface "port 11"
set ha-mgmt-interface-gateway 10.33.69.46
end

Yes, a very strange situation has come out, that's why you can't make decisions on a tired stupid head. It was in the instructions to clear the interface, but before that I was setting up a different type of device and a little confused in the concepts, I thought that now I'm just going to write the address where the monitoring data will be sent.

[Debbie_FTNT]

Hey Dubos,

ah, if you edited your HA interface, the interface settings I outlined above still apply, but the static route does not, HA interface is separate from regular routing and access.
just make sure that the interface gateway in HA settings is correct; that provides an implicit default route from the HA interface.
If you want to test that the HA interface can reach its gateway or your local subnet, you can ping from it as follows:
#execute enter vsys_hamgmt
#execute ping 10.33.69.46 (or any other IP)

Hope this helps!
If you find you're somehow not able to revert the changes you made yesterday, you can just configure an interface and static route to regain GUI access, restore a previous good configuration, and then re-do whatever changes you made yesterday properly :)

[Dubos]

So, I set up the address on the interface that I had rewritten before. I added accesses and a static mod there. I checked the routing, there was already the correct gateway, I added the same dst as the management address. And also "execute enter sys_am gmt" outputs "current vcom=sys_am gmt:5", I think it means that everything is fine with HA cluster.
But access to GUI and SSH has not yet appeared. 
I don't understand what else to do.

[Dubos]

From the ViPNet coordinator, whose address I have in the static route as gateway, I can ping my FortiGate, and it responds. But when I try to ping from FortiGate, the packets don't know where to go.

[Dubos]

By the way, I tried to run ARP table, the command seems to be running, but it's empty and nothing happens. This is not normal and may help to understand the situation.

[Dubos]

Although if I search ARP table in a different way, then it gives something.
BoarderRTK_Fortigate (root) # diagnose ip arp list
index=26 ifname=root 0.0.0.0 00:00:00:00:00:00 state=00000040 use=370373 confirm=376373 update=370373 ref=1
index=44 ifname=root.b 10.32.32.57 state=00000001 use=0 confirm=376680 update=291 ref=6

[Debbie_FTNT]

Hey Dubos,

ok, that was a lot to go through.
The 'execute enter vsys_hamgmt' command lets you switch to the light-weight HA mgmt vdom that is created and which handles communication via HA mgmt port.
Once you are in the VDOM, you can run the arp command/ping command etc from there and should see information specific to the HA mgmt interface and its routing.

If you're not getting a response when pinging after using the 'execute enter vsys_hamgmt' command, that could indicate a network or config issu such as an incorrect IP somewhere.
You can try the "execute traceroute" command (after "execute enter vsys_hamgmt") to see how many hops you can go down.
You can also run the diag sniffer command inside the vsys_hamgmt VDOM to and then ping towards the FortiGate, and verify that the ping is arriving and being replied to.
If your issues still persist, you might want to consider opening a Technical Support case and requesting a session so someone can dig into your FortiGate configuration with you and determine what's going on.
Also, as noted above, if for some reason you can't get it working again, you can simply create a GUI connection option and using that to restore an older config file (from before you accidentally removing important IP settings).

[Dubos]

I've been digging around and it seems to me that I understand a little what the problem really was. We have three working interfaces (and one spare), two of them were configured for cluster synchronization, and one, respectively, is the main one for management. When I made a mistake, I rewrote one of the cluster synchronization interfaces, registering the main management port there, and when I "repaired" it, I wrote the management address in this port.
That is, now my management port is one of the cluster synchronization interfaces (HA cluster is working, I checked), but the rest of the settings remain the same on both fortigate and routers, so I can now ping it and connect through another forigate cluster because it approaches it from the other side. It might be easier to install a backup so as not to mess up something else.