Issue with setting up two Firewall Fortigate 300C clusters on same LAN

[marcin2k]

We have 2 firewall clusters consisting of fortigate 300C models with internal interface on both to the same local network (172.1.0.0/24). Each cluster has dedicated connections for clustering control lines.

Cluster 1 interface IP: 172.1.80.200/24

Cluster 2 interface IP: 172.1.88.200/24

This internal IP address is used to as well manage the firewall.

When both clusters are UP then only Cluster 2 interface is not stable. Ping frequently times out to cluster 2 IP. When Cluster 1 is shutdown then Cluster 2 has no issue. Behaviour is as if there was an IP conflict but there is none.

Cluster 2 was loaded by taking the configurations backups from Cluster 1 and modifying some parameters such as interface IPs.

Any idea why this setup does not work or any hints what to check? There are no IP conflicts in the design.

Thanks

[Toshi_Esumi]

Have you tried sniffing on the cluster1 side when you're pinging the cluster2 IP? Assuming nothing is there. Then probably you need to use wireshark or something to sniff on the line into cluster2, means at the switch, to get a clue.

[MikePruett]

Are these devices in production? What level of "downtime" are you able to create with these things live?

I would try building the HA from scratch again and then just copy and pasting firewall objects, policies, etc

[marcin2k]

After troubleshooting and reading forums I found the solution. Both firewalls had the default group-id set for HA.

When you put two firewall clusters on the same LAN you need to make sure each cluster uses unique group-id.

To change:

config system ha

   set group-id <integer>

end

[Ralph1973]

I think you use the same (default) group id on the ha settings, this creates a conflict. Create an unique group id for each cluster.

Kind regards,

Ralph Willemsen

Arnhem, Netherlands