Add new member to firewall cluster

[torenhof]

Hello All,

At a client, I have some issues adding a "newly" received fortigate 100D after one defective member has been replaced by Fortigate.

The problem is that the firewalls now have different buildnumbers and when I try to join the new member, I get the following warning:

fortinet HA cannot be formed because the internal ports of box is in different mode with this box, ...

I have checked the interface name and they are different on the two boxes.

On the primary node, it's name is: internal

on the received node, it's name is: lan

I have one backup of the primary node that has been working as standalone during a year and a half.

The current firmware version = FG100D-5.02-FW-build618-140915

I have uploaded the firmware through TFTP in the preboot menu (on received node).

How can I restore the HA with these two firewalls?

I need to change the cfg file of the working firewall? If so, what and where?

I can change the name of the interface on the received firewall?

I've been searching four a couple of days to solve this issue, and I've not been able to find the right solution yet.

Thanks and best regards,

Torenhof

[AtiT · Accepted solution]

Hello,

According to FortiOS 5.2 Handbook:

You can add a repaired or replacement unit to a functioning cluster at any time. The repaired or replacement cluster unit must: 1) Have the same hardware configuration as the cluster units. Including the same hard disk configuration and the same AMC cards installed in the same slots. 2) Have the same firmware build as the cluster. 3) Be set to the same operating mode (NAT or Transparent) as the cluster. 4) Be operating in single VDOM mode.

I think the Part Number is a part of the hardware configuration.

I checked some 100D units and found out that:

System Part-Number: P11510-02 has internal switch ports. System Part-Number: P11510-03 has lan switch ports.

I think you can reopen the ticket at Fortinet and ask for the part number you need and replace the unit.

I am just wondering whether you are using the ports as switched ports. If not, maybe you can try to disable the switch ports and have separate ports like port1, port2, etc... Probably they will be the same on all devices.

[torenhof]

AtiT wrote:

Hello,

According to FortiOS 5.2 Handbook:

You can add a repaired or replacement unit to a functioning cluster at any time. The repaired or replacement cluster unit must: 1) Have the same hardware configuration as the cluster units. Including the same hard disk configuration and the same AMC cards installed in the same slots. 2) Have the same firmware build as the cluster. 3) Be set to the same operating mode (NAT or Transparent) as the cluster. 4) Be operating in single VDOM mode.

I think the Part Number is a part of the hardware configuration.

I checked some 100D units and found out that:

System Part-Number: P11510-02 has internal switch ports. System Part-Number: P11510-03 has lan switch ports.

I think you can reopen the ticket at Fortinet and ask for the part number you need and replace the unit.

I am just wondering whether you are using the ports as switched ports. If not, maybe you can try to disable the switch ports and have separate ports like port1, port2, etc... Probably they will be the same on all devices.

The firewall is configured to use it's ports in switched ports, so it is not realy an option.

I will contact Fortigate once more and will request an firewall with an equal build number.

Thanks for your input.

[torenhof]

AtiT wrote:

Hello,

According to FortiOS 5.2 Handbook:

You can add a repaired or replacement unit to a functioning cluster at any time. The repaired or replacement cluster unit must: 1) Have the same hardware configuration as the cluster units. Including the same hard disk configuration and the same AMC cards installed in the same slots. 2) Have the same firmware build as the cluster. 3) Be set to the same operating mode (NAT or Transparent) as the cluster. 4) Be operating in single VDOM mode.

I think the Part Number is a part of the hardware configuration.

I checked some 100D units and found out that:

System Part-Number: P11510-02 has internal switch ports. System Part-Number: P11510-03 has lan switch ports.

I think you can reopen the ticket at Fortinet and ask for the part number you need and replace the unit.

I am just wondering whether you are using the ports as switched ports. If not, maybe you can try to disable the switch ports and have separate ports like port1, port2, etc... Probably they will be the same on all devices.

I have managed to setup the cluster again.

So what I did:

Execute the command exec ha ignore-hardware-revision on both machines and rebooted them.

I changed the config of the primary node, I changed HA settings (priority) and changed the hostname.

After that, I've joined the secondary member  to the cluster again.

the HA leds became green on both firewalls and when checking the synchronization of the cluster, I saw no errors.

I've tested the cluster by rebooting the firewall (primary & secondary) several times and I only lost one ping or so.

My main question is if this setup is ok?

When I've tried according to this:

http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/clustering.082....

I kept receiving the errors about the boxes being in different modes. And couldn't make this secondary unit join the cluster, even when executing the ignore-hardware-revision.

Thanks,

Gerrit

[Ralph1973]

Hi, I think you do mean with different mode, that one unit has configured its lan ports in switch mode.

What I always do when replace a defective unit is connect the new unit to your computer with fortiexplorer and then first load the correct software and then restore the config.

Is that what you need?

Kind regards,

Ralph Willemsen

[torenhof]

Ralph1973 wrote:

Hi, I think you do mean with different mode, that one unit has configured its lan ports in switch mode.

What I always do when replace a defective unit is connect the new unit to your computer with fortiexplorer and then first load the correct software and then restore the config.

Is that what you need?

Kind regards,

Ralph Willemsen

Hello Ralph,

I have done as you described, but I've uploaded the firmware through tftp, and afterwards I've used the configuration file of the primary member, changed hostname & HA parameters in this file and uploaded this config to the new member. After that I added this new member to the cluster. HA status shows being ok.

So I think it's ok.

Regards