Problem with server access using teamed NICs to FortiGate HA pair

[albaker1]

We have a vendor who has 2 servers with 2 NICs configured with teaming. Port 1 of each server is directly plugged into port 2 of each FortiGate (also belongs to vendors, and these are 60E's running 7.0.x). We've been testing failover, and it's been problematic. At least one server, sometimes both, will be unreachable when we test failover. We can disconnect the cables to the standby FortiGate, and the servers are instantly reachable. Even after the server is reachable, as soon as we plug the cable back into the FortiGate, the server is sometimes unreachable.

We've not had any experience with this before, but then all FortiGates we manage have ports plugged into switches. Are there any ideas as to what we can try? Thanks

[BillH_FTNT]

Hi @albaker1 

Could you please share the configuration on both the server and the FortiGate related to teaming? and

Did you try sniffing packets on both FortiGate devices?

diagnose sniff packet "port x" none 6 0 l

If you have any logs, please share them here or send them to me at bhoang@fortinet.com if possible. Thank you.

Bill

[albaker1 · Accepted solution]

Thanks for your time on this, BillH.

I lost my last response when I accidentally pressed the wrong key. In a nutshell, we put a switch in between the servers and FortiGates (the ports for the servers were all put into a single software switch on both FortiGates) and determined the server wouldn't failover the NICs as long as the standby FortiGate interface was up. The only way for us to get traffic to flow from the server to the correct FortiGate was to disable the appropriate interface on the new standby firewall.

This wasn't a firewall issue - the internal virtual switch on the VMware host didn't respond properly to gratuitous ARPs IMO, and even when we enabled the one command (forgot what this was) that momentarily takes down the FortiGate interface on the new standby unit, the traffic would be directed out the NIC to the standby FortiGate as until that interface on the standby went active - the server would then direct all traffic out to the standby FortiGate.

We were able to resolve the issue by placing all server and firewall network interfaces into switchports of a separate physical switch, so the servers can now reach the active firewall no matter which firewall is active.

[BillH_FTNT]

@albaker1 

Thank you for your information!

Bill