Lost MGMT after configure HA A-P

[luca1994]

Hello Team,

i have two FGT-400F.

when I configure HA in A-P mode I lose access to mgmt, or rather, I keep losing packets and sometimes I have response but then I lose them again.

HA status seems ok from cli but secondary appears out-of-sync

HA Health Status: OK
Model: FortiGate-400F
Mode: HA A-P
Group: 0
Debug: 0
Cluster Uptime: 0 days 0:43:2
Cluster state change time: 2025-05-05 15:12:06
Primary selected using:
<2025/05/05 15:12:06> FG4H0FTXXXXXXX is selected as the primary because it has the largest value of override priority.
ses_pickup: enable, ses_pickup_delay=disable
override: disable
Configuration Status:
FG4H0FTXXXXXXX (updated 1 seconds ago): in-sync
FG4H0FTYYYYYYY (updated 2 seconds ago): out-of-sync
System Usage stats:
FG4H0FTXXXXXXX (updated 1 seconds ago):
sessions=11, average-cpu-user/nice/system/idle=0%/0%/1%/98%, memory=20%
FG4H0FTYYYYYYY (updated 2 seconds ago):
sessions=0, average-cpu-user/nice/system/idle=0%/0%/0%/99%, memory=19%
HBDEV stats:
FG4H0FTXXXXXXX (updated 1 seconds ago):
ha: physical/1000auto, up, rx-bytes/packets/dropped/errors=8544725/20866/0/0, tx=9549211/22088/0/0
FG4H0FT924904723(updated 2 seconds ago):
ha: physical/1000auto, up, rx-bytes/packets/dropped/errors=9547147/22081/0/0, tx=8541769/20862/0/0
Primary : FGT-1, FG4H0FT924904724, HA cluster index = 0
Secondary : FGT-2, FG4H0FT924904723, HA cluster index = 1
number of vcluster: 1
vcluster 1: work 169.254.0.1
Primary: FG4H0FTXXXXXXX , HA operating index = 0
Secondary: FG4H0FTYYYYYYY , HA operating index = 1

Do you have any suggestions?

Thanks for the support

BR

[Toshi_Esumi]

If you made the mgmt port for "dedicated to management", HA operation would exclude the port config from the config sync. That's why you can set different IP on mgmt for those two FGTs. This means even when they're not in sync, you should have steady access to the secondary mgmt port.

Share us the HA config in CLI under "config system ha" as well as "config system ha -> edit mgmt".

Toshi
 

[luca1994]

Hello @Toshi_Esumi ,

following output from console of firewall primary

config system ha
set group-name "ClusterFGT"
set mode a-p
set password XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
set hbdev "ha" 0
set session-pickup enable
set override disable
set priority 200
end

following output from console of firewall secondary

config system ha
set group-name "ClusterFGT"
set mode a-p
set password XXXXXXXXXXXXXXXXXXXX
set hbdev "ha" 0
set session-pickup enable
set override disable
set priority 150
end

however, it still overwritten my MGMT conf because in secondary conf I see the same ip. I changed it but still both ips are not reachable.

Thanks for the support

BR

[Toshi_Esumi]

You are missing this part in the HA config:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-dedicated-mgmt-feature-Out-of-ba...

Toshi

[luca1994]

@Toshi_Esumiso with the dedicated-to-management parameter in the mgmt conf should the “management interfaces reservations” flag be configured in the HA conf by entering the mgmt interface there?

Thanks for the support

BR

[Toshi_Esumi]

I'm not too familiar with the GUI (I always configure HA in CLI). But I would assume if you specify "mgmt" for the reserved interface in GUI, the interface config is automatically set as "dedicated-to management".

The result should look like below. This is one of our 1000F HA cluser's.
FG1K0Fxxxxxxxx (mgmt) # show
config system interface
  edit "mgmt"
    set ip x.x.x.x 255.255.255.248
    set allowaccess ping https ssh
    set type physical
    set dedicated-to management
    set snmp-index 35
  next
end

Toshi

[luca1994]

the set dedicated-to-management parameter is enabled directly in the con of the interface. When I have the two firewalls still in standalone I reach both mgmt correctly but when I configure ha I lose them both and I can't figure out why. which piece am I missing?
Thanks for the support

[Toshi_Esumi]

In the KB:

config system ha

    set ha-mgmt-status enable

        config ha-mgmt-interfaces

            edit 1

                set interface port10

                set gateway 10.10.10.10

            next

        end

end

That's the only place you can configure the GW IP for both units' out-of-band management network.

Toshi

[luca1994]

so for me is not port10 mgmt, right?

[Toshi_Esumi]

whatever you want to make it as the out-of-band mgmt interface. You never mentioned port10  before. But why don't you want to use "mgmt" port while the 400E has it?

Toshi