FortiGate Active-Standby Cluster - Seperate Management IP addess

[pj255]

Hi,

We're running a pair of 1000C's in A-P (v5.0,build3608 (GA Patch 7)).

We currently manage both FW's using MGMT1 with one dedicated IP.

Does anyone how to give the primary and secondary separate dedicated MGMT IP's ?

I'd like to use MGMT 1 on Primary and MGMT 2 on secondary - each with a different IP address.

Thanks,

PJ

[Jeff_FTNT]

It look some thing is wrong.

After Slave upgrade, it will new master, old Master will upgrade image.

Before you do upgrade, make sure HA is synchronize well, check it with CLI:dia sys ha showcsum , both master and slave should have same checksum.Thanks.

[Fullmoon]

Hi Jeff,

heres the outcome. thank you

diagnose sys ha showcsum 

is_manage_master()=1, is_root_master()=1

debugzone

global: 1b 2f 63 20 de 0b 2f 53 5c 73 b6 05 7a 52 ef d9 

root: 78 02 f6 24 d1 d0 df 50 10 4c a2 84 d3 0f d2 a6 

all: d9 b0 e0 10 5b 63 f5 e8 11 a4 9f b3 86 26 02 ba 

 

checksum

global: 1b 2f 63 20 de 0b 2f 53 5c 73 b6 05 7a 52 ef d9 

root: 78 02 f6 24 d1 d0 df 50 10 4c a2 84 d3 0f d2 a6 

all: d9 b0 e0 10 5b 63 f5 e8 11 a4 9f b3 86 26 02 ba 

[Jeff_FTNT]

Hi Fullmoon,

From output, your HA is synchronized. Thanks.

[Fullmoon]

hi Jeff, my HA is now working. From ver 4.0 MR3 P18 I jumped in to Ver 5.0.4 not 5.0.0. Im not quite sure why 5.0.0 is not working well in HA firmware upgarde.

Additional verification do I need to perform the same action if Im going to upgrade HA in A-P mode? Thanks

[Jeff_FTNT]

Upgrade from v4.3  to v5.0 need special step, can not jump directly.

I remember it need upgrade to the newest v4.3 , then upgrade to v5.0. You may find some DOC on support site.

Like:http://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0CCUQFjAB&url=http%...

Thanks.

[Toshi_Esumi]

At least we didn't have any problem upgrading from v4.3.14 directly to v5.0.7. From there we could go to v5.0.9.

Since the last SSL bug, I recommend v5.0.7 or above. Also upgrading to v5.0 will throw some overlapped subnets/duplicated entries, and so on. All should be in config-error-log.

[ede_pfau]

In FortiOS v5.2.3 (at least), these settings can be made directly in the GUI, Config > HA. Really straightforward.

[Petzocles]

I have done:

set ha-mgmt-status     enable  set ha-mgmt-interface   xx  set ha-mgmt-interface-gateway x.x.x.x

but now I see that HA synchronises mgmt IP's 

so now both nodes have the same mgmt IP and now I even can manage none of the nodes via network. not even in the segment itself! 

how can I make sure he does not sync the IP address!

[rough]

You should config reserved management interface first.

To configure the reserved management interface - web-based manager 1. Go to System > Config > HA. 2. Edit the primary unit. 3. Select Reserve Management Port for Cluster Member and select portxxx. 4. Select OK.

You can also get more information here: http://docs.fortinet.com/...88/fortigate-ha-50.pdf

[mark9885]

Any idea why this 200D I'm setting up will not allow the mgmt interface to be selected as: Reserve Management Port for Cluster Member ?

Doesn't work via the GUI as well.

For info I'm trying to set 2 of these up remotely and just have the mgmt link connected at the moment.

CH01FW00 # config system ha

CH01FW00 (ha) # set ha-mgmt-status enable

CH01FW00 (ha) # set ha-mgmt-interface mgmt node_check_object fail! for ha-mgmt-interface mgmt

value parse error before 'mgmt' Command fail. Return code -23