load balancer - first alive. not works.

[matteocostanzo]

Hi everyone

I'm trying to configure a virtual server with load balancer that searches for the first live IP.

I have M2M SIMs behind a VPN, each of which can take 2 random static IPs.
based on the restart of the SIM itself.

I wanted to disguise this inconvenience with a virtual server.

but if I use first alive mode it doesn't work.

I don't understand what I'm doing wrong.

edit "SIM-1"
set uuid fb8bxxxxxxxxxxxxxxxxxxx1016f70e
set type server-load-balance
set extip 172.33.0.1
set extintf "any"
set server-type ip
set ldb-method first-alive
config realservers
edit 1
set ip 10.176.154.3
next
edit 2
set ip 10.168.152.68
next
end

[ozkanaltas]

Hello @matteocostanzo ,

You said it doesn't work, can you give more information about what doesn't work? 

Also, did you configure a health check for your real server? If you don't, the virtual server can't detect which real server running or not.

If you want to get more information about Virtual Server, you can review this document.

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/713497/virtual-server-load-b...

[matteocostanzo]

for example at this moment the SIM has taken the second IP.

If I ping the virtual server it doesn't work.

if instead I ping the two real ones the right one responds.

I put the Health check monitoring ping

Esecuzione di Ping 172.33.0.1 con 32 byte di dati:
Richiesta scaduta.
Richiesta scaduta.
Richiesta scaduta.
Richiesta scaduta.
Richiesta scaduta.

Esecuzione di Ping 10.176.154.3 con 32 byte di dati:
Richiesta scaduta.
Richiesta scaduta.
Richiesta scaduta.
Richiesta scaduta.

Esecuzione di Ping 10.168.152.68 con 32 byte di dati:
Risposta da 10.168.152.68: byte=32 durata=184ms TTL=60
Risposta da 10.168.152.68: byte=32 durata=139ms TTL=60
Risposta da 10.168.152.68: byte=32 durata=157ms TTL=60
Risposta da 10.168.152.68: byte=32 durata=109ms TTL=60
Risposta da 10.168.152.68: byte=32 durata=119ms TTL=60
Risposta da 10.168.152.68: byte=32 durata=159ms TTL=60

edit "SIM-1"
set uuid fb8bxxxxxxxxxxxxxxxx6f70e
set type server-load-balance
set extip 172.33.0.1
set extintf "any"
set server-type ip
set monitor "Ping-10-2-3"
set ldb-method first-alive
config realservers
edit 1
set ip 10.176.154.3
next
edit 2
set ip 10.168.152.68
next
end
next

[ozkanaltas]

Hello @matteocostanzo ,

Can you share these command outputs with us? 

diagnose debug enable
diagnose firewall vip realserver list
diagnose firewall vip realserver healthcheck stats show

Maybe the problem is related to source IP. Can you configure the source IP to your monitor? 

config firewall ldb-monitor
    edit "Ping-10-2-3"
        set src-ip x.x.x.x
    next
end

[matteocostanzo]

As long as I was waiting for a response I realized that the problem is actually the health monitor which isn't working.

What is the IP address I need to set??

a firewall interface ip??

otherwise I didn't understand??

vf=0 name=SIM-1/35 class=4 type=5 172.33.0.1:(0-0), protocol=0
total=2 alive=0 power=0 ptr=434200670
ip=10.168.152.68-10.168.152.68/0 adm_status=0 holddown_interval=300 max_connections=0 weight=1 option=01
alive=0 total=1 enable=00000001 alive=00000000 power=0
src_sz=0
id=0 status=down ks=0 us=0 events=0 bytes=36120 rtt=0
ip=10.176.154.3-10.176.154.3/0 adm_status=0 holddown_interval=300 max_connections=0 weight=1 option=01
alive=0 total=1 enable=00000001 alive=00000000 power=0
src_sz=0
id=0 status=down ks=0 us=0 events=0 bytes=0 rtt=0

vip: SIM-1
--------------------------
time since last status change: 507
num of successful checks since last status change: 0
num of failed checks since last status change: 296
num of times server up->down: 0
num of times server down->up: 0
num of times server failovers: 0
num of ping detects performed: 302
num of failed ping detects: 302
num of tcp detects performed: 0
num of failed tcp detects: 0
num of http detects performed: 0
num of failed http detects: 0
num of https detects performed: 0
num of failed https detects: 0
num of dns detects performed: 0
num of failed dns detects: 0

Real server status: VIP=SIM-1
2: ip=10.168.152.68, port:0, mode:Active, health check status:DOWN
3: ip=10.176.154.3, port:0, mode:Active, health check status:DOWN

[ozkanaltas]

Hello @matteocostanzo ,

Yes, you can configure the interface IP address of Fortigate. 

The important thing is that the source IP address you give must be able to access the relevant real servers.

[matteocostanzo]

I configured the ip source in ping-10-2-3 and created a rule so that the firewall interface can reach the real servers
but the rule doesn't make traffic and still doesn't work.

do I have to enable anything else???

[ozkanaltas]

Hello @matteocostanzo ,

For health check traffic no need for a firewall policy if you don't have another firewall. 

Also if you didn't create a firewall policy with a Virtual server, the virtual server doesn't check your real server. Did you create a firewall policy with your Virtual Server? 

Also, can you send the debug command output again? 

[matteocostanzo]

Yes, I created a policy that points to the virtual server.

if I remove the health check and put only one real server.

ping starts working properly.

If I put everything back as before it stops working.

vf=0 name=SIM-1/35 class=4 type=5 172.33.0.1:(0-0), protocol=0
total=2 alive=0 power=0 ptr=434200670
ip=10.168.152.68-10.168.152.68/0 adm_status=0 holddown_interval=300 max_connections=0 weight=1 option=01
alive=0 total=1 enable=00000001 alive=00000000 power=0
src_sz=0
id=0 status=down ks=0 us=0 events=0 bytes=36120 rtt=0
ip=10.176.154.3-10.176.154.3/0 adm_status=0 holddown_interval=300 max_connections=0 weight=1 option=01
alive=0 total=1 enable=00000001 alive=00000000 power=0
src_sz=0
id=0 status=down ks=0 us=0 events=0 bytes=0 rtt=0

vip: SIM-1
--------------------------
time since last status change: 12374
num of successful checks since last status change: 0
num of failed checks since last status change: 7364
num of times server up->down: 0
num of times server down->up: 0
num of times server failovers: 0
num of ping detects performed: 7370
num of failed ping detects: 7370
num of tcp detects performed: 0
num of failed tcp detects: 0
num of http detects performed: 0
num of failed http detects: 0
num of https detects performed: 0
num of failed https detects: 0
num of dns detects performed: 0
num of failed dns detects: 0

Real server status: VIP=SIM-393310397449
2: ip=10.168.152.68, port:0, mode:Active, health check status:DOWN
3: ip=10.176.154.3, port:0, mode:Active, health check status:DOWN
--------------------------

[matteocostanzo]

I understand why it's not working.

I have to present myself on the other side behind a NAT.

how do I tell him at health check to get to the other side nat???