Regression with 7.4.7 over 7.4.3 on Fortigate FGT80F - LDAP no longer works on secondary units

[Konnan]

Hello!

We just upgraded our FGT80F firewalls from 7.4.3 to 7.4.7 and LDAP no longer works on the secondary units, it only works on the primary units when trying to log on. We have to use the emergency local account if we want to log in the secondary unit.

We have two active passive clusters, and we have the same issue on both clusters, the secondary can only be accessed with the local account.

My teammate found this article, maybe we are hitting this : https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-local-out-traffic-blocked-by-HA-debu...

But in all cases, I think we should be able to log in using LDAP in the secondary if we need to.

Any ideas to troubleshoot this?

At first sight, we get "local-out traffic, blocked by HA" when trying to do Packet Trace.

Hoping everything is clear, if there's anything, please ask!

Thanks!

Konnan

[Konnan]

@dingjerry_FTNT 

Forgot to ask, why it was working before?

Thanks!

Konnan

[dingjerry_FTNT]

And I don't have your previous configuration and debugs, so I have no idea why it was working before.

But when it was NOT working, I am pretty sure that it was due to missing the "ha-direct" setting in HA settings.

[Konnan]

Hello again @dingjerry_FTNT !

I have a previous backup and it was working perfectly on all four (4) firewalls, 2 per cluster. We were on firmware FGT80F-7.4.3-FW-build2573-240201

Just wondering why it was working before because it looks like a regression to me and if we can do without this setting, we would prefer that.

Here it is below:

config system ha
set group-name "XYZ-ABCD-EF"
set mode a-p
set password ENC *** redacted ***
set hbdev "a" 50 "b" 50
set route-ttl 30
set session-pickup enable
set session-pickup-delay enable
set ha-mgmt-status enable
config ha-mgmt-interfaces
edit 1
set interface "internalx"
set gateway xx.x.xxx.x
next
end
set override disable
set priority 64
end

Thanks!

Konnan

[Konnan]

Hello @dingjerry_FTNT 

It fixed the issue and I didn't have to replicate it on the secondary, it did it by itself.

On the other hand, we are wondering about possible side effects. We would like to only enable ha-direct on LDAP requests.

I found that we can do it for snmp:

config system snmp user

    edit snmpv3-user

        set ha-direct enable

    next

end

Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Sending-messages-logs-SNMP-RADIUS-directly...

That reference seems to indicate it's possible to enable ha-direct for many individual uses instead of globally.

So I tried:

config user ldap

edit ldapuser

set ha-direct enable

But with no luck. Is there an alternative way to do this or ha-direct enable can't be only enabled for LDAP requests?

Hoping everything is OK, if there's anything else, do not hesitate to ask.

Thanks!

Konnan

[dingjerry_FTNT]

Hi @Konnan ,

You have to enable "ha-direct" in HA settings to make it work.

[sferoz]

Hi Konnan,
When testing in lab, using LDAP/LDAPS auth for admin users we couldn't able to see an issue on both primary and secondary unit logging after upgrading FGT from 7.4.3 to 7.4.7 in HA A-P. May I confirm the upgrade path had been followed, when upgrading from 7.4.3 to 7.4.7. 

Kindly check HA synchronization status and try resetting the LDAPS/LDAP setting’s, for LDAPS once you have CA certificate of the LDAP server imported into the FortiGate, enable the CA cert under conf user ldap settings and verify if the connection status are successful.

If still an issue, please help collect the below logs during LDAP auth login testing:
get sys stat
get sys ha stat
di de config-error-log read
di de crashlog read

Debug:
diagnose debug enable
diagnose debug application fnbamd 255
to stop : diagnose debug application fnbamd 0

Sniffer:
di sniffer packet any "port 389 or port 636" 6 0 l

Thanks.

[Konnan]

It is still an issue. I collected the logs as required.

Connection status is failing with "Can't contact LDAP server" in the GUI. Yet, same exact configuration on both of them.