Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
pj255
New Contributor

FortiGate Active-Standby Cluster - Seperate Management IP addess

Hi,

 

We're running a pair of 1000C's in A-P (v5.0,build3608 (GA Patch 7)).

 

We currently manage both FW's using MGMT1 with one dedicated IP.

 

Does anyone how to give the primary and secondary separate dedicated MGMT IP's ?

 

I'd like to use MGMT 1 on Primary and MGMT 2 on secondary - each with a different IP address.

 

Thanks,

PJ

1 Solution
kritt
New Contributor II

Hello mark9885,

 

I 've had the same error.

In my case, this error has been resolved by deleting :

- static route associated to mgmt

- source-ip setting in the syslog server config

 

Maybe that the error could appear if the mgmt interface is part of  firewall policies, this error could appear to.

 

I guess that the interface has not to be part of a specific configuration before to be used as reserved management interface.

 

 

View solution in original post

22 REPLIES 22
Jeff_FTNT
Staff
Staff

It look some thing is wrong.

After Slave upgrade, it will new master, old Master will upgrade image.

 

Before you do upgrade, make sure HA is synchronize well, check it with CLI:dia sys ha showcsum , both master and slave should have same checksum.Thanks.

Fullmoon

 

Hi Jeff,

heres the outcome. thank you

diagnose sys ha showcsum 
is_manage_master()=1, is_root_master()=1
debugzone
global: 1b 2f 63 20 de 0b 2f 53 5c 73 b6 05 7a 52 ef d9 
root: 78 02 f6 24 d1 d0 df 50 10 4c a2 84 d3 0f d2 a6 
all: d9 b0 e0 10 5b 63 f5 e8 11 a4 9f b3 86 26 02 ba 
 
checksum
global: 1b 2f 63 20 de 0b 2f 53 5c 73 b6 05 7a 52 ef d9 
root: 78 02 f6 24 d1 d0 df 50 10 4c a2 84 d3 0f d2 a6 
all: d9 b0 e0 10 5b 63 f5 e8 11 a4 9f b3 86 26 02 ba 

Fortigate Newbie

Fortigate Newbie
Jeff_FTNT
Staff
Staff

Hi Fullmoon,

From output, your HA is synchronized. Thanks.

Fullmoon

hi Jeff, my HA is now working. From ver 4.0 MR3 P18 I jumped in to Ver 5.0.4 not 5.0.0. Im not quite sure why 5.0.0 is not working well in HA firmware upgarde.

Additional verification do I need to perform the same action if Im going to upgrade HA in A-P mode? Thanks

Fortigate Newbie

Fortigate Newbie
Jeff_FTNT
Staff
Staff

Upgrade from v4.3  to v5.0 need special step, can not jump directly.

I remember it need upgrade to the newest v4.3 , then upgrade to v5.0. You may find some DOC on support site.

 

Like:http://www.google.ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0CCUQFjAB&url=http%...

 

Thanks.

Toshi_Esumi
SuperUser
SuperUser

At least we didn't have any problem upgrading from v4.3.14 directly to v5.0.7. From there we could go to v5.0.9.

Since the last SSL bug, I recommend v5.0.7 or above. Also upgrading to v5.0 will throw some overlapped subnets/duplicated entries, and so on. All should be in config-error-log.

ede_pfau
SuperUser
SuperUser

In FortiOS v5.2.3 (at least), these settings can be made directly in the GUI, Config > HA. Really straightforward.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Petzocles

I have done:

 

set ha-mgmt-status     enable  set ha-mgmt-interface   xx  set ha-mgmt-interface-gateway x.x.x.x

 

but now I see that HA synchronises mgmt IP's 

so now both nodes have the same mgmt IP and now I even can manage none of the nodes via network. not even in the segment itself! 

 

how can I make sure he does not sync the IP address!

 

 

rough

You should config reserved management interface first.

To configure the reserved management interface - web-based manager 1. Go to System > Config > HA. 2. Edit the primary unit. 3. Select Reserve Management Port for Cluster Member and select portxxx. 4. Select OK.

You can also get more information here: http://docs.fortinet.com/...88/fortigate-ha-50.pdf

mark9885
New Contributor

Any idea why this 200D I'm setting up will not allow the mgmt interface to be selected as: Reserve Management Port for Cluster Member ?

 

Doesn't work via the GUI as well.

 

For info I'm trying to set 2 of these up remotely and just have the mgmt link connected at the moment.

 

CH01FW00 # config system ha

CH01FW00 (ha) # set ha-mgmt-status enable

CH01FW00 (ha) # set ha-mgmt-interface mgmt node_check_object fail! for ha-mgmt-interface mgmt

value parse error before 'mgmt' Command fail. Return code -23

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors