HA broken - how do i fix?

[silversurfer]

Hi all, My HA broke, when i plug in firewall 1 lan both firewalls goes offline (non functional). From the support tells me to do a factory reset and then set group-id etc. Did a factory reset and of course i can' t connect to firewall 1 (i' m off site). Is there a way to connect to it, true firewall 2 (cli)? I have only WAN and sync connected between the firewalls and i don' t see any ip on sync-inteface. Is the console the only way now (on site)? How do i recreate the HA easiest and best way? thx

[ede_pfau]

After a factoryreset the interface IPs revert to the defaults. ' internal' will be 192.168.1.99, ' wan' 192.168.0.99 - OR the other way around. I think management will be enabled on ' internal' . But the routing will not be correct. In short, no way to manage the FGT. As HA is not configured after a reset you cannot manage it across the HA link. I can only assume you didn' t tell Fortinet support that you are offsite when they recommended a factory reset...

[Maik]

as ede said. the firewall will use factory default IP' s on those Interfaces' s. figure out which Interfaces are used and what services are enabled on that interface. (Community might help you, when you post your FGT Model) dependent on the model, ssh or telnet is enabled on that interface too. then, you might be able to configure the same interface of your reachable Fortigate to be in the same subnet as your factory default Fortigate. from cli you could use exec telnet or exec ssh to connect to the factory default fortigate. example: Factory Default Fortigate: Port1 - 192.168.1.99 Your Reachable Fortigate(Master): Port1 - 192.168.1.42 it can be configured as secondary IP. exec telnet 192.168.1.99

[ede_pfau]

Maik is right, no need to give up so soon (thanks!). Even if the running FGT' s interface IP address is not in the default subnet of the second FGT, you can make it work by the help of ' poor man' s routing' : define an IP pool on the interface connected to the second FGT and source-NAT the traffic. Example: the active FGT has 10.11.12.12 on ' internal' the second FGT has 192.168.0.99 on ' internal' Both ' internal' interfaces are connected via a switch. On the active FGT: Create an IP pool with one address: 192.168.0.88 Create a policy ' internal' ->' internal' , source: ANY, dest: IP_pool Now, traffic from the active FGT' s ' internal' interface will seemingly come from the same subnet that the second FGT uses. Thus, the second FGT will not have to use a route back. You should be able to connect to the second FGT via https://192.168.0.99 or via ssh (the default admin methods). good luck!

[silversurfer]

Many thanks for all replies! How do i sync it to the Master? Whats the procedure? I can' t find anything in kb or manual? thx

[ede_pfau]

The slave will sync automatically while entering the cluster. How far did you go? If you still can reach the slave by it' s IP address then the HA cluster has not formed yet.

[silversurfer]

Hi! Thanks, will start configuring it now, i wonder what the default login is.. : ) Also got this from support: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30985&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=40032905&stateId=0%200%2040034015 How to rebuild HA

[silversurfer]

Default login Admin - no password. :) So its up. I only managed to access the FW via Port 1 - interface switch. I did configure it as the master, different ips on port 15-16, failover on port 9. No access. I checked https, ssh and ping. Did a policy for port 15, LAN, to access everything, i cant even ping. I can see that it finds the master on port 9 and as i can see the connection is only a klicka away. Same time im getting nervous - is it that easy or can i mess up the master to so nothing works? I' m accessing the FW thru port 1 - default ip and setup. Why doesn' t port 15, LAN work? What more do i have to do? thx

[silversurfer]

Ah, i have to switch mode - from switch to interface! When i try i get " Entry used" How do i change mode?

[Paul_Dean]

You have to remove all config that references the " internal" interface from the configuration. Typically you will have a firewall policy and DHCP server. Possibly a DNS server too.