Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Just wondering if anyone out there has any ideas on how best to do this ?
Port monitor just look at "link state" . If link goes down, the master device will be replace with the slave one.
There are some cli commands that can help you .Please look at cli refrence.
config system ha
set pingserver-failover-threshold <threshold_integer> set pingserver-flip-timeout <timeout_integer> set pingserver-monitor-interface <interface_names>
end
and ping server is here:
config router gwdetect edit <interface_name> set server <servername1_string> set source-ip <ipv4_addr> set protocol {ping |tcp-echo | udp-echo} set interval <seconds_int> set failtime <attempts_int> set ha-priority <priority_int> end
You can change ha-priority.
Not really - if you can configure a ping server then the FGT does NOT act on link status alone but on ping replies (host alive) as well! Link status is just that the interface reports that a device is connected (the LED is lit).
HA port monitoring is not as sophisticated as link health monitoring in load balancing but IMHO it doesn't need to. Either the HA backup unit is present and running or not. Which protocol would you like to test anyways, I mean, against a HA unit?
In 5.2 dead gateway detection is replaced with "Link-monitor":
config system link-monitor
FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C
if you are looking to depend on ping then you wont depend on interface state its more over link availability, while Port monitoring is for the port state (up/down)
..
FCSNP 5, JNCIS-FW,JNCIA-SSL ,MCSE, ITIL.
Hi all
We have a couple of internal networks (subnets) on the HA cluster. (internal ports configured on each of the FG's)
Each will have their own connection to a switch.
Naturally the connections on the slave FG will be in standby.
But should the upstream connection to the switch that connects one of the internal networks on the master fail, the FG cluster will not know about it.
As far as its concerned the switch / link state is up and there is no need to failover.
But comms would be lost unless we can configure each port on the FW to monitor something upstream. (e.g ping a server)
What do you think ?
g
Just go ahead and do it: configure a ping server for the WAN side, one ping server for the internal side and link monitoring (using these ping servers!) for the HA.
The inter-HA link should be a direct connection by all means! Do not run that across a switch. Use a redundant HA link if possible, with the second connection along a different path. I even use colored cables for the HA link so that they won't get pulled inadvertedly. Reason: if the HA link fails both members recon they are solitary and both assume the master role - with the same IP and MAC addresses on the same LAN ('cluster split'). This will cause a lot of trouble.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1705 | |
1093 | |
752 | |
446 | |
230 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.