Hi,
I am trying to use API call to configure the HA on FortiGate VM on OCI cloud with following payload and getting error. Looks like current API does not either recognize "hadev" field value or expecting in certain format. I have tried using "hbdev": "\"port4\" 50" or "hbdev": "port4 50" or "hbdev": " port4" but nothing worked. Also error message output showing "No permisson to change HA setting" , I wonder if this API doesnt work with access_token?
I also tried to use Ansible module "“fortios_system_ha” on https://galaxy.ansible.com/fortinet/fortios
but it also gives almost the same issue related to "hvdev". Has anyone encounter this issue or any suggestions?
following is code excerpt:
api_url = "https://192.13.154.13/api/v2/cmdb/system/ha/?access_token=fj7pwG93nxz6xxxxxxxx"
data_api = {
"group-id": 30,
"group-name": "ha-cluster",
"mode": "a-p",
"hbdev": "port4 50",
"session-pickup": "enable",
"session-pickup-connectionless": "enable",
"ha-mgmt-status": "enable",
"ha-mgmt-interfaces": [
{
"interface": "port1",
"gateway": "192.168.1.1"
}
],
"override": "disable",
"priority": 200,
"unicast-hb": "enable",
"unicast-hb-peerip": "192.168.4.20"
}
headers_api = {
"Content-Type": "application/json"
}
r2 = requests.put(api_url, json=data_api, verify=False, headers=headers_api )
print(r2.text)
Following is error I am getting:
{
"http_method":"PUT",
"revision":"7b1485a77e93e18d4d4711c00b47a1d3",
"revision_changed":false,
"cli_error":"node_check_object fail! for hbdev port4\nInvalid value port4\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\nobjname=ha, size=3352, sz_attr=0, offset=240, attrsize=160\npath=system, objname=ha, size=3352, sz_attr=2\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\npath=system, objname=ha, size=3352, sz_attr=1\ncmd_clean_context 0, abort=0\nNo permisson to change HA setting\nobject check operator error, -37, discard the setting\nCommand fail. Return code -37\n",
"error":-37,
"status":"error",
"http_status":500,
"vdom":"root",
"path":"system",
"name":"ha",
"serial":"XXXXXXXXXXX",
"version":"v7.2.4",
"build":1396
}
ON the FortiGate VM console , I get following errors about "hbdev":
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'group-id'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'group-name'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'mode'
[httpsd 7189 - 1680118685 error] api_set_cmdb_attr[2339] -- cmd_check_value failed for node 'hbdev': 'port4' (err=-651)
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'hbdev'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'hbdev'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'unicast-hb'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'unicast-hb-peerip'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'session-pickup'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'session-pickup-connectionless'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'ha-mgmt-status'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'interface'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'gateway'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'override'
[httpsd 7189 - 1680118685 info] api_set_cmdb_attr[2393] -- 'priority'
0: config system ha
0: set group-id 30
0: set group-name "ha-cluster"
0: set mode a-p
0: unset hbdev
0: set hbdev "port4" 50
0: set session-pickup enable
0: set session-pickup-connectionless enable
0: set ha-mgmt-status enable
0: set override disable
0: set priority 200
0: set unicast-hb enable
0: set unicast-hb-peerip 192.168.4.20
-37: end
[httpsd 7189 - 1680118685 info] cmdb_save_with_children[280] -- appended main node (nret=-37, is_new=0)
[httpsd 7189 - 1680118685 error] cmdb_save_with_children[285] -- saving failed for main node: 'ha' (err=-37)
[httpsd 7189 - 1680118685 error] cmdb_commit_from_json[2162] -- error saving request object to CLI (-37)
[httpsd 7189 - 1680118685 error] _api_cmdb_v2_config[1455] -- error editing object (nret=-37)
[httpsd 7189 - 1680118685 warning] api_return_http_result[1272] -- API error -37 raised
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hey Use
"hbdev": "port4" 50 - so as per the config which we see on CLI port 4 is string and 50 is integer
if still not working try to remove 50 just put "hbdev": "port4" and check if it's working then we can fig out the way to put 50
Also please confirm if you have vdoms on this firewall ?
Hi,
I have tried using "hbdev": "\"port4\" 50" or "hbdev": "port4 50" or "hbdev": " port4" but nothing worked. There is only single vdom "root" there. No other vdoms.
As per API doc for 7.2.4 , it has to be string as follows:
hbdev | string Heartbeat interfaces. Must be the same for all members. |
So it can be "hbdev": "\"port4\" 50" or "hbdev": "port4 50" or "hbdev": " port4" but not accepting any of these.
Also in the output we see message "No permisson to change HA setting\nobject check operator error, -37" . So I am not sure if this API request works with access_token authentication. Fortinet developers can confirm , however, I dont see any response yet.
Thanks
It's a bug with the API. The only way I've been able to get it to work is by using an ansible-driven bash script
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1640 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.