Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ehammett
New Contributor

How to reboot active-passive cluster?

I currently have a Active-Passive cluster between to Fortigate 110C devices. If I reboot the Master does it transfer the operations to the slave device? I would like to just reboot the device without anything failing over. Is this possible?
8 REPLIES 8
ede_pfau
SuperUser
SuperUser

Hi, I would think that - reboot via the GUI would reboot all cluster members - reboot via CLI, started from a local CLI, would reboot that machine only Frankly, I' ve never rebooted a cluster just for fun; only during firmware updates. You can access the member' s CLI via
 exe ha man <ID>
 exe reboot
where ID would be 0 or 1. When you first login via ssh, you' re on the master unit. You can get the IDs with ' diag sys ha status' . If you just reboot the master via ' exe rebo' then of course it will failover to the slave. If you reboot the slave noone will notice...
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
ehammett
New Contributor

Hi thanks for the reply. I am not just rebooting it for fun, the problem I am having is the master device is not showing the correct active Fortiguard services. For instance the Web Filtering is showing expired however it is good for another year (even according to the Fortinet support website). So for whatever reason it is not being updated or synchronizing with the Fortinet support website. When I have seen this in the past a simple reboot of the device usually fixed it however I was unsure what the consequence would be in this instance. Do you know of a way to force the Fortiguard services to be updated to their correct information?
ede_pfau
SuperUser
SuperUser

I' ve seen that with other FGTs before. Sometimes activating ' push updates' did it; the FGT has to register with the next FortiGuard server to leave its WAN IP there, and at that occasion the services info was updated. You might give it a try. Usually the slave lags behind, even in signature updates. From the theory this shouldn' t happen. Promoting the slave fixes this for a while.
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Matthijs
New Contributor II

on the cli:
 execute update-now
 
ede_pfau
SuperUser
SuperUser

That will only force a signature update; the crucial point is that the unit should first register with the FDS server:
 config system autoupdate push-update
     set status enable
 end
 
An actual update is not necessary then.
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Matthijs
New Contributor II

I have solved the same problem just by trying a signature update via the CLI ;-) Although the command should do a signature update, it solves the registration problems some sometimes. Rebooting a unit via the GUI does activate the slave, and the slave does not reboot. So you could just reboot the master that way.
laf
New Contributor II

What command did you used?

The most expensive and scarce resource for man is time, paradoxically, it' s infinite.

The most expensive and scarce resource for man is time, paradoxically, it' s infinite.
JRdiaz

 i have similar problem as well. my fortiguard connection was not working, it was not verifying URL categories...so  i went to config > fortiguard > web filtering and Email filtering options > i chose Use Alternate Port (8888)  and it started working.. 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors