FortiManager: Cluster Member shown as down

[JasperFreeman]

Hi, I made the mistake of issuing a ' shutdown' instead of a ' reboot' on the master FW (i.e., fw01). The system has been restarted, login with ssh is possible, ' get system ha status' shows both master and slave are up. However, in FortiManager, the master (fw01) is shown as down. Refresh the devices or cluster produces nothing. How can I get FortiManager to recognise the master as being up. I thought I could delete the member that is shown as down, but am not sure. Has anyone else had this problem? Can you let me know what I need to do to get FortiManager to recognise the cluster member? Thanks in advance. Jasper Freeman

[AndreaSoliva]

Hi I know my answer sounds for you probably silly :) but there is one fact I was fighting arround! My answer would be and only for a try: - activate https on the interface fgfm The reason why such a silly answer is following: There is a command which establishs the fgfm tunnel new: # execute fgfm reclaim-dev-tunnel [Device Name] This command ist also used if you change a device from Serial A to B which means before you do: # execute device replace sn [Device Name] [New Serial] If you do so you will never bring up the connection again. If you sniff you will recognize a lot of syn but no ack. The reason for this is that because of the serial change the FMG must establish a new connection based on Port 541 and SSL encryption. This means also with the admin and related password a new preshared secret SSL connection will be estabslished. For this the FGM must reach the https port (probably by in the background using the SSL library). I was testing this and spending a lot of time. Since I know this -and if I have problems with a connection meaning connection down- I try out of the box a refresh. If this is not working I open quick https and wait for a minute and after I try again and it works :) Do not ask me if this is a bug or " it works as designed" ....no idea. This morning I had such a device. Correctly established and working for days. This morning this firewall had a issue and was rebooted. After the reboot the connection was not coming up again. I restarted the dev tunnel no change. I opened https and it works from scratch.....again silly I know but it works :-) What I have to say addtional is that I do not manage the device from FGM as incoming connection which means only outgoing connection from FGM is allowed to the device. No VIP or incoming from device to the FMG is allowed. Anyway activate quick https on the device and give it a try..probably it helps. Again silly I know but probably it helps. have fun Andrea

[Sean_Toomey_FTNT]

Hi Jasper, If that doesn' t fix your issue, please open a case with TAC so they can resolve your issue. I do know that removing and readding the device to FortiManager would probably solve that, but I' d like to try to get this working without resorting to that. Cheers!