HA: Changing config on slave replicates to master

[neonbit]

Hi all,

I was testing out some HA features today and ran into something that didn't quite feel right. Hoping to get some feedback if this is expected or not.

On two FGT-VM01 devices running 5.2.1, I've configured them into a HA pair with a master (priority 200) and a slave (priority 100).  Everything connects and works fine and each device assumes its correct master/slave status.

Next I configured separate management interfaces for each and logged directly into the slave webGUI.

I noticed that any changes I made to the slave (like delete/adding policies) was immediately replicated to the master config. I assumed that any changes made on the slave unit should be overwritten by the master as soon as the config was sync'd but this doesn't seem to happen.

Does this sound right to you guys?

[ksm]

Hi all, 

this post is old but not answered, so I ask you exactly the same question but now in my context we are in 5.6.3 on a 300 E cluster. I pass by the CLI command "exe ha manage", i go on the slave, change something, and, it is replicated.

I do not understand why, because we are in an active-passive mode.

Thanks in advance for enlightening us.

Best regards.

JS

KERBEROS Support

[Toshi_Esumi]

First, you should never try changing the config on the slave. I don't think it's designed to react that kind of abnormal situation. I think that's why original post never got a reply.

Then if you still want the answer, open a TT at TAC. They might tell you the same.

[ksm]

Hi Toshi,

thanks for your quick reply, I will then create a case on FORTINET Support.

Best regards.

JS

[ede_pfau]

IMHO this is exactly the expected behavior. Both units are kept synchronized. If you change the config on the slave it keeps the master up-to-date. I've noticed this some time ago and used it to test the 2-way-replication. So, in my opinion, this works as expected.

And yes, this setup is a bit pathological. You would almost always only change one of the 'exclusive' settings directly on the slave, e.g. it's hostname or HA settings. Relieving to know that synchronization works both ways which might be just convenient.

[ksm]

Hi, 

thanks for your answer, it is the good behavior. The FORTINET Help page, given to me by an Exclusive Employee, enlightened me :)

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-high-availability-52/HA_failoverSyncC...

The citation from the help page: "When you log into a subordinate unit CLI (for example using execute ha manage) all of the configuration changes that you make to the subordinate unit are also immediately synchronized to all cluster units, including the primary unit, using the same process."

Bonnes fêtes ! 

P.S. :  Je ne sais pas comment clore le post, mais il faudrait du coup, c'est résolu :)