We have two 100d in HA mode. When I shutdown the master using the CLI is there a way to bring it up from the command line again without physically turning it off and back on again? If not, is there a better way to bring down the master and let the slave take over and bring it back up again through the CLI...Gregg
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Gregg,
When you issue the shutdown command ('exec shutdown'), you are essentially forcing a system halt. You cannot bring the unit back up using software after that point.
To test HA failover, you have a couple options:
1. Reset uptime with override disabled
2. Change the device priority with override enabled
3. Bring a monitored interface administratively down
4. In 5.2, manually set a unit as the new master (this command does not survive a reboot)
In HA, the default precedence for choosing a master in a new cluster is:
1. Number of monitored interfaces that are up (the unit with the highest number is chosen)
2. Uptime (ignoring a default difference of five minutes, or 300 seconds)
3. Device priority
4. Serial number, as a tiebreaker
Device priority is a static number you configure under 'config system ha'. The default is 128, so both would need to be changed to have an impact on the overall selection process.
If you enable override, two things happen: priority is considered before uptime, and in the event of a failover, the master role in a cluster can fail back to the original master if the unit recovers; otherwise, by default, the failover is permanent until reboot.
With override disabled, assuming either no links are monitored, or they are equally healthy, uptime is the first real criterion. If you enter 'diag sys ha reset-uptime' on the master (master because it already won by having the highest uptime), its notional uptime for the purposes of HA will be set to 0, and the slave will take over. If you do the same thing to the slave (now the new master), you can effect a failback.
With override enabled, the defaults if left alone will still allow you to failover using uptime, but the purpose of enabling override in the first place is really so that you can set the device priorities. In this case, for instance, with the master set to have a priority of 200 and the slave to have 100, changing the numbers so that the slave has a higher priority (say, 225) will cause a failover. Doing the reverse would cause a failback.
You could also bring a monitored link down on one of the units if you monitor link health.
Finally, in 5.2, there is a new command: 'diag sys ha set-as-master'. That's not the full command: there are a few options. You could enable it: 'diag sys ha set-as-master enable', disable it outright, or else disable it on a schedule. Say you want the slave to take over for 10 minutes of testing, for instance. Just enter 'diag sys ha set-as-master ?' to see all the options.
Regards, Chris McMullan Fortinet Ottawa
That worked perfect!!...Thanks...
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1641 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.