Lost MGMT after configure HA A-P

[luca1994]

Hello Team,

i have two FGT-400F.

when I configure HA in A-P mode I lose access to mgmt, or rather, I keep losing packets and sometimes I have response but then I lose them again.

HA status seems ok from cli but secondary appears out-of-sync

HA Health Status: OK
Model: FortiGate-400F
Mode: HA A-P
Group: 0
Debug: 0
Cluster Uptime: 0 days 0:43:2
Cluster state change time: 2025-05-05 15:12:06
Primary selected using:
<2025/05/05 15:12:06> FG4H0FTXXXXXXX is selected as the primary because it has the largest value of override priority.
ses_pickup: enable, ses_pickup_delay=disable
override: disable
Configuration Status:
FG4H0FTXXXXXXX (updated 1 seconds ago): in-sync
FG4H0FTYYYYYYY (updated 2 seconds ago): out-of-sync
System Usage stats:
FG4H0FTXXXXXXX (updated 1 seconds ago):
sessions=11, average-cpu-user/nice/system/idle=0%/0%/1%/98%, memory=20%
FG4H0FTYYYYYYY (updated 2 seconds ago):
sessions=0, average-cpu-user/nice/system/idle=0%/0%/0%/99%, memory=19%
HBDEV stats:
FG4H0FTXXXXXXX (updated 1 seconds ago):
ha: physical/1000auto, up, rx-bytes/packets/dropped/errors=8544725/20866/0/0, tx=9549211/22088/0/0
FG4H0FT924904723(updated 2 seconds ago):
ha: physical/1000auto, up, rx-bytes/packets/dropped/errors=9547147/22081/0/0, tx=8541769/20862/0/0
Primary : FGT-1, FG4H0FT924904724, HA cluster index = 0
Secondary : FGT-2, FG4H0FT924904723, HA cluster index = 1
number of vcluster: 1
vcluster 1: work 169.254.0.1
Primary: FG4H0FTXXXXXXX , HA operating index = 0
Secondary: FG4H0FTYYYYYYY , HA operating index = 1

Do you have any suggestions?

Thanks for the support

BR

[luca1994]

port10 is mentioned in your example.

I just want to configure has to form a 400f cluster. I don't understand why when I enable ha with shared con I lose access to management.

firewalls have dedicated mgmt

thanks 

[Toshi_Esumi]

That's just KB's example. If you want to use mgmt on your 400F, just need to translate it to "mgmt". Then specify the GW IP/subnet at the HA config. Then, HA operation should exclude the interface from sync and the general routing-table.

Toshi

[luca1994]

ok now it is clear and tomorrow i will try. i just ask you one last thing. 

but can it be that when i did the conf ha i did ok too early in the individual configurations ha of the two firewalls? I confirmed them with 3 seconds difference. Maybe that is why I lose the management

[Toshi_Esumi]

Maybe. But I really don't know the behavior if you didn't specify mgmt as "dedicated-to" while the "mgmt" port is "dedicated-to" by default. I never tried that way.

Toshi

[dingjerry_FTNT]

Hi @luca1994 ,

1) First of all, I don't think that you can configure "dedicated-to management" to port10. 

2) To clarify:  

2.1) Interfaces with "dedicated-to management" setting will be synced between the Primary and Secondary units.

2.2) The "dedicated-to management" setting is to exclude this interface from some configurations, like firewall policy, addresses, and so on.

2.3) If this "dedicated-to management" interface is not used in any other configuration, such as DHCP server, it can be used as an HA dedicated management interface as well.

2.4) As an HA dedicated management interface, the settings with this interface will NOT be synced between the Primary and Secondary units.

[luca1994]

hello @dingjerry_FTNT,

in fact it comes back now. i performed these steps.

fgt1 standalone with ip of mgmt reachable.

fgt2 standalone with ip of mgmt reachable

only thing is i confirmed both conf HA with 2/3 seconds difference.

Conf ha on fgt1 with heartbeat interface HA 

conf ha on fgt2 with heartbeat interface ha

when I click ok on both conf I have the ip address of mgmt (which is now shared for both) flapping. 

I see from cli that fgt2 is in out of sync (obviously access via gui i lost it because the ip flaps)

The only thing is that I confirmed the conf has at a distance of 2/3 seconds 

[dingjerry_FTNT]

Hi @luca1994 ,

1) "when I click ok on both conf I have the ip address of mgmt (which is now shared for both) flapping. "

If you have no HA dedicated management interface configured, it is expected that you have access with one mgmt IP only (the IP is from the Primary unit).

In this case, you can always access the Secondary unit in CLI using the "execute ha manage" command.

2) "I see from cli that fgt2 is in out of sync (obviously access via gui i lost it because the ip flaps)"

2.1) It takes time for HA cluster members to be in sync.

2.2) I don't understand what you mean by " IP flaps".  I guess you can only access the GUI using the mgmt IP from the Primary unit, right?  If so, it is expected and this is called synced, not flapped, and expected for the mgmt IP if you have no HA management interface configured.

3) "The only thing is that I confirmed the conf has at a distance of 2/3 seconds "

I don't understand this.  If you mean, the system time is 2/3 seconds difference between two FGT units, it's fine.

[luca1994]

Hello @dingjerry_FTNT ,

By flapping I mean that after configuring ha, the management ip address (which in standalone mode responds correctly to ping) loses packets when I ping it and I don't understand why.

By point 3 I mean that I applied the conf ha at practically the same time on the nodes, maybe that is what creates the problem that the di management responds at times.

Thanks for the support

BR

[dingjerry_FTNT]

OK, so this issue is NOT called flapping.  It's called losing access.

As we ( @Toshi_Esumi  and I ) explained, you have to use the HA management interface. 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-Reserved-Management-Interface/ta-p/1901...

[luca1994]

Thanks again.

Just for clarify I am bringing back configurations from old cluster 500e to new cluster 400f if I want to share management ip address? The old cluster 500e shares it and I brought back exactly the conf has, I don't understand about why I lose management. If it works on the old cluster why not on the new cluster.

BR