unable to configure HA with REST API v7.2.4 for FortiGate VM

[mhca99]

Hi,
I am trying to use API call to configure the HA on FortiGate VM on OCI cloud with following payload and getting error.  Looks like current API does not either recognize "hadev" field value or expecting in certain format.  I have tried using "hbdev": "\"port4\" 50"  or   "hbdev": "port4 50"   or  "hbdev": " port4"  but nothing worked.  Also error message output showing "No permisson to change HA setting" , I wonder if this API doesnt work with access_token?

I also tried to use Ansible module "“fortios_system_ha” on https://galaxy.ansible.com/fortinet/fortios

but it also gives almost the same issue related to "hvdev".  Has anyone encounter this issue or any suggestions?

following is code excerpt:

api_url = "https://192.13.154.13/api/v2/cmdb/system/ha/?access_token=fj7pwG93nxz6xxxxxxxx"

data_api = {
"group-id": 30,
"group-name": "ha-cluster",
"mode": "a-p",
"hbdev": "port4 50",
"session-pickup": "enable",
"session-pickup-connectionless": "enable",
"ha-mgmt-status": "enable",
"ha-mgmt-interfaces": [
{
"interface": "port1",
"gateway": "192.168.1.1"
}
],
"override": "disable",
"priority": 200,
"unicast-hb": "enable",
"unicast-hb-peerip": "192.168.4.20"
}

headers_api = {
"Content-Type": "application/json"
}

r2 = requests.put(api_url, json=data_api, verify=False, headers=headers_api )

print(r2.text)

Following is error I am getting:

{
"http_method":"PUT",
"revision":"7b1485a77e93e18d4d4711c00b47a1d3",
"revision_changed":false,
"cli_error":"node_check_object fail! for hbdev port4\nInvalid value port4\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\nobjname=ha, size=3352, sz_attr=0, offset=240, attrsize=160\npath=system, objname=ha, size=3352, sz_attr=2\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\ncmd_clean_context 0, abort=0\nNo permisson to change HA setting\nobject check operator error, -37, discard the setting\nCommand fail. Return code -37\n",
"error":-37,
"status":"error",
"http_status":500,
"vdom":"root",
"path":"system",
"name":"ha",
"serial":"XXXXXXXXXXX",
"version":"v7.2.4",
"build":1396
}

ON the FortiGate VM console , I get following errors about "hbdev":

[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'group-id'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'group-name'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'mode'
[httpsd 7189 - 1680118685 error] api_set_cmdb_attr[2339] -- cmd_check_value failed for node 'hbdev': 'port4' (err=-651)
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'hbdev'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'hbdev'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'unicast-hb'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'unicast-hb-peerip'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'session-pickup'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'session-pickup-connectionless'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'ha-mgmt-status'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'interface'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'gateway'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'override'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'priority'
0: config system ha
0: set group-id 30
0: set group-name "ha-cluster"
0: set mode a-p
0: unset hbdev
0: set hbdev "port4" 50
0: set session-pickup enable
0: set session-pickup-connectionless enable
0: set ha-mgmt-status enable
0: set override disable
0: set priority 200
0: set unicast-hb enable
0: set unicast-hb-peerip 192.168.4.20
-37: end
[httpsd 7189 - 1680118685 info] cmdb_save_with_children[280] -- appended main node (nret=-37, is_new=0)
[httpsd 7189 - 1680118685 error] cmdb_save_with_children[285] -- saving failed for main node: 'ha' (err=-37)

[httpsd 7189 - 1680118685 error] cmdb_commit_from_json[2162] -- error saving request object to CLI (-37)
[httpsd 7189 - 1680118685 error] _api_cmdb_v2_config[1455] -- error editing object (nret=-37)
[httpsd 7189 - 1680118685 warning] api_return_http_result[1272] -- API error -37 raised

[Ankush]

Hey Use 

"hbdev": "port4" 50 - so as per the config which we see on CLI port 4 is string and 50 is integer

if still not working try to remove 50 just put "hbdev": "port4" and check if it's working then we can fig out the way to put 50 

Also please confirm if you have vdoms on this firewall ?

[mhca99]

Hi, 

I have tried using "hbdev": "\"port4\" 50"  or   "hbdev": "port4 50"   or  "hbdev": " port4"  but nothing worked.   There is only single vdom "root" there.  No other vdoms. 

As per API doc for 7.2.4 , it has to be string as follows:

hbdev

string Heartbeat interfaces. Must be the same for all members.

So it can be "hbdev": "\"port4\" 50"  or   "hbdev": "port4 50"   or  "hbdev": " port4" but not accepting any of these. 

Also in the output we see message "No permisson to change HA setting\nobject check operator error, -37" . So I am not sure if this API request works with access_token authentication.  Fortinet developers can confirm , however, I dont see any response yet.

Thanks

[dd_from_statefarm]

It's a bug with the API.  The only way I've been able to get it to work is by using an ansible-driven bash script