Regression with 7.4.7 over 7.4.3 on Fortigate FGT80F - LDAP no longer works on secondary units

[Konnan]

Hello!

We just upgraded our FGT80F firewalls from 7.4.3 to 7.4.7 and LDAP no longer works on the secondary units, it only works on the primary units when trying to log on. We have to use the emergency local account if we want to log in the secondary unit.

We have two active passive clusters, and we have the same issue on both clusters, the secondary can only be accessed with the local account.

My teammate found this article, maybe we are hitting this : https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-local-out-traffic-blocked-by-HA-debu...

But in all cases, I think we should be able to log in using LDAP in the secondary if we need to.

Any ideas to troubleshoot this?

At first sight, we get "local-out traffic, blocked by HA" when trying to do Packet Trace.

Hoping everything is clear, if there's anything, please ask!

Thanks!

Konnan

[funkylicious]

maybe this, https://community.fortinet.com/t5/FortiGate/Technical-Tip-LDAPS-connections-no-longer-work-after-upd...  ?

[Konnan]

I tried it, without success. Thanks for the tip anyway!

[Konnan]

Thanks funkylicious! I'll have a look and report back.

What's really curious is that it's working well on both primaries units. I'll double check.

[dingjerry_FTNT]

Hi @Konnan ,

If you are using regular LDAP, not LDAPS, you may not have the same issue as the one in that KB.

Please share your HA settings.

[Konnan]

Hello @dingjerry_FTNT I tried to share HA settings here with get sys ha stat, maybe my post was lost for some reason. Which settings do you want to look at?

[dingjerry_FTNT]

Hi @Konnan ,

I wanna see whether you have the HA management interface and/or "ha-direct" setting configured or not.

[Konnan]

Hello @dingjerry_FTNT 

By the way, forgot to say in my last post that you were right, I'm not in LDAPS, I'm in LDAP with STARTTLS.

As requested, if you need anything else, don't hesitate to ask.

XYZ-ABCD-EF-2 # show system ha
config system ha
set group-name "XYZ-ABCD-EF"
set mode a-p
set password ENC (***redacted***)

set hbdev "a" 50 "b" 50
set route-ttl 30
set session-pickup enable
set session-pickup-delay enable
set ha-mgmt-status enable
config ha-mgmt-interfaces
edit 1
set interface "internalx"
set gateway xx.x.xxx.x
next
end
set override disable
set priority 64
end

XYZ-ABCD-EF-2 #

Thanks!

Konnan

[dingjerry_FTNT]

Hi @Konnan ,

You do have the HA management interface configured, but no "ha-direct" setting enabled.

Please try the following:

config sys ha

set ha-direct enable

end

Then reproduce it to see whether it will fix this issue or not.

[dingjerry_FTNT]

@Konnan , forgot to mention, once you enable the "ha-direct" setting, please enter into the secondary device to make sure that the setting is there.