Unabe to log into the standby fortigate in Active/passive mode (HA)

[jomfra]

Hello Expert,

I have to two fortigate 400e in HA setup, but I am unable to connect to standby one when I use the Management port on the device,

How can I log into the device when it is standby mode?.

Thank you

Regards

[funkylicious · Accepted solution]

Hi,

One option would be to login on the active one and do something like, execute ha manage <ID> <username> .

Did you do something similar like described in this article : https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-Reserved-Management-Interface/ta-p/1901... ? 

[mle2802]

Hi @jomfra,
The best way is to use CLI from active one https://community.fortinet.com/t5/FortiGate/Technical-Tip-Managing-individual-cluster-units-with-the...

Regards,
Minh

[Toshi_Esumi]

Based on your description, I assume you're looking for a way to access the secondary unit's MGMT port directly via GUI. And further assume you want to do this via GUI as well.

First check how you configured HA at the primary (it probably reflects how you did at the secondary as well) then you might need to adjust.

What you want to do is to reserve the MGMT(mgmt) interface for management only (keep it outside of HA sync) and set the gateway IP in the management subnet, then set one IP from the subnet on the mgmt interface.
You need to do the same but with a different IP from the same subet on the secondary. You probably need to separate HQ to access the secondary via GUI. But I assume you know how to do it safely already.

Then the rest is obviously you need to set up the management network with a switch(es) to be able to route your access via a gateway device so that you can access both unit directly and simultaneously.

If you can do this via CLI (there are some document available) you don't have to break HA to configure the secondary but follow what @funkylicious  and @mle2802 posted. Just expect you might get kicked out when you save the change in "config sys ha"

Below is from our primary 1000D/7.0.13 under System->HA and Network->interface->mgmt1. The secondary has x.x.x.59/29 on mgmt1.

<HA config>

<mgmt1 config>

Toshi