Hi, I have two fortigate 200B (5.0.11) in active-active mode, but from today there is only a small balance of tcp sessions. master has 1571 in ESTABLISHED state , but subordinate has 3 in ESTABLISHED state.
could someone help me
thanks a lot
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Qs:
Q1: was this working before or did this just now stop
Q2: if yes, is the 2nd unit all healthy
Q3: what does your load-balance under "config system ha" show ALL UDP etc.....
Q4: was any changes made in the HA configuration of the configuration
PCNSE
NSE
StrongSwan
q1-> yes before q2-> I can connect to it by ssh without problem or webpage and I do not see problem q3-> fortigate1 (ha) # get group-id : 0 group-name : FGT mode : a-a password : * hbdev : "port9" 50 "port10" 50 session-sync-dev : route-ttl : 10 route-wait : 0 route-hold : 10 sync-config : enable encryption : disable authentication : disable hb-interval : 2 hb-lost-threshold : 6 helo-holddown : 20 gratuitous-arps : enable arps : 5 arps-interval : 8 session-pickup : disable update-all-session-timer: disable session-sync-daemon-number: 1 link-failed-signal : disable uninterruptible-upgrade: enable ha-mgmt-status : enable ha-mgmt-interface : port14 ha-mgmt-interface-gateway: 10.131.124.1 ha-eth-type : 8890 hc-eth-type : 8891 l2ep-eth-type : 8893 ha-uptime-diff-margin: 300 vcluster2 : disable vcluster-id : 1 override : disable priority : 200 schedule : round-robin monitor : "port13" "port15" pingserver-monitor-interface: pingserver-failover-threshold: 0 pingserver-flip-timeout: 60 vdom : "root" load-balance-all : disable q4-> no changes
thanks
load-balance-all : disable
Can you adjust this? Was it ever adjusted? ( look at your config system ha options from the cli ( load-balance ) )
edit: please becarefull if you load-balance all or make adjustments. I would do this on a load peak hour and monitor for the next 1-4 days for any issues. Sometime A-A doesn't work very good imho and experience.
PCNSE
NSE
StrongSwan
I have just reboot subordinate fortigate and now the balance is better.
master Active Sessions= 8355 and subordinate= 1123
thanks
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.