Active-Active HA Problem (Slave device is unreachable)

[farhang_gh]

Dear guys,

We have two FortiGate 300E in an active-active cluster. HA port is up, configuration sync is OK and everything looks fine.

But the slave device is unreachable. We cannot ping any interface on slave device when directly connecting the slave device to laptop. Ping reply is "destination host is unreachable".

Then I enabled load-balance-all through command line, but same result.

Do you have any suggestion?

Thanks

[ede_pfau · Accepted solution]

On the master unit, in CLI "exec ha manage 0" - can you login (telnet) across the HA link this way?

[farhang_gh]

Hi,

Yes I could.

[farhang_gh]

Any idea?

[rdumitrescu]

Hi,

In a A/A cluster you a have a primary unit and a subordinate unit (Slave)

The subordinate unit is not meant to process arbitrary traffic but only the sessions that are offloaded to the subordinate unit by the primary unit.

In order words, the session setup always happen on the primary unit, then the primary unit can decide to offload the session to the subordinate unit.

Regards

Radu

[farhang_gh]

Hi,

Thanks for your answer, but even if I enabled load-balance-all? Or even by enabling sync packets?

In other words, no way for having two devices responsible to networks?

Thanks

[rdumitrescu]

No, you cannot have two devices that actively process traffic.

The primary unit receive the traffic and decide to load-balance to other subordinate unit if the criteria is matched.

For better understanding you can find all the details under the section: HA and load balancing

https://docs.fortinet.com/uploaded/files/4304/fortigate-ha-60.pdf

Regards

Radu

[lobstercreed]

What you *can* do is manage them using a special management interface as mentioned here:

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-high-availability-52/HA_operatingRes...

This is mainly so you can manage the second unit via GUI or for other monitoring(SNMP), but you can do what you need through CLI per Ede's response.