FortiAuthenticator HA issue

[Elkomy]

Hello,

i have an issue on FortiAuthenticator HA on virtual machine,

when trying to create HA Active-Passive between two virtual machine the HA status on the two nodes become primary with one has high priority and the second has low priority but no sync happen between the both devices

i have attached a copy of the config of the ha setting on both devices

[sjoshi]

Hi,

Try to collect below logs and see if you get any error

https://<fac>/debug/slony

Your HA itself is not forming.

Also you can take pcap on the FAC on udp port 720 and for config snyc on tcp port 5432

[Elkomy]

hello,

i hope you do well

kindly note that i have error on ha log and i will attach the log file and when i try to capture traffic over port 720 and view it on wireshark it  found that the source and destination is from APIPA and the error

[sjoshi]

can you also check if you are able to ping the FAC Node IP from each other

[Elkomy]

yes i can ping the other node on any ip of the two interfaces and the same issue @sjoshi any recommendation

[sjoshi]

can you also share the snapshot of the pcap where you see APIPA IP communication.

[Elkomy]

kindly find the attached snapshot

[Elkomy]

@sjoshi   any solution

[sjoshi]

When observing 169.254.x.x IPs, it's expected behavior in an HA environment. These IPs are automatically assigned for HA communication in addition to the configured HA interface IPs. Capturing packets on the HA link will reveal UDP traffic on port 720 involving the 169.254.x.x addresses.

Regarding the error message, "ERROR: relation _fac_ha.sl_local_node_id does not exist", this typically appears during the initial cluster setup or when nodes are attempting to synchronize. If the cluster forms correctly, these messages generally disappear after a short time.

However, if these errors persist, it likely indicates that the nodes can detect each other but are unable to establish a cluster due to some configuration or communication issue.

Recommended Actions:
Upgrade Firmware: If you're running version 6.2, consider upgrading to 6.3 or 6.4, as clustering issues have been noted in 6.2.
Reinitialize HA: Disable HA on both units, then re-enable it to reset the clustering process.
Simultaneous Reboot: Restart both units at the same time to ensure clean synchronization, as a high uptime on one unit may sometimes cause clustering discrepancies.
Key Verifications:
Ensure no network devices (e.g., firewalls or routers) are blocking communication between the nodes. HA setup relies on Layer 2 connectivity and Ethernet broadcasts.
Verify that both units share the same cluster password.
Confirm direct Layer 2 connectivity between the nodes without any filtering or interruptions.
Taking these steps should help resolve clustering issues and ensure a stable HA setup.

[Elkomy]

i have tried all the above solution and still the same issue does the issue on virtual machine environment i mean i already tried the ha on physical appliance and it is working well but i need to do the lap for learning purposes and it not work for me