Fortigate HA: how to locate switch port connected to passive unit?

Question

In a new customer's network I have found the following scenario:

• Fortigate 1 and 2 form and HA cluster in active-passive mode. The HA link is just a cable connecting them directly.
• Racks A and B are a several meters apart and cables between them run through the ceiling. It is not possible to follow them and they are not identified: no pannels, no labels, ...
• Port 1 of each Fortigate is connected to a switch but customer doesn't know the switch ports.
• All switch ports are access ports in the default VLAN. Fortigate port 1 is default gateway for the subnet associated to this VLAN

In order to locate the switch ports, I considered connecting my PC in one switch, setting up an address of the subnet and ping the default gateway. Then check ARP looking for the MAC address of the default gateway and finally search for this MAC address in the CAM of both switches. However, I realized this will make me discover only the switch port connected to the active Fortigate unit.

Is there a way to track down the switch port connected to the passive Fortigate unit, without disconnecting the cable on firewall side, neither forcing a transition of the cluster active unit?

Answer 1

What you can do is SSH to the Active unit, then run:

execute ha manage <x>

where x is the ID of the other unit.

Then run

config system interface
edit "port1"
set status down
next 
edit "port1"
set status up
end

You can then log on to the switch (assuming it is logging interface UP/DOWNS) and see which interface went down.

Answer 2

There is no direct way to determine the slave's MAC of port1 as both HA cluster member units share identical virtual MACs for each port.
Disconnecting (or disabling) a port has a 50% chance of triggering a cluster failover, with subsequently dropping some traffic.

To minimize network interruption I'd disable port monitoring for port1 temporarily, in the HA config setup. Then pull one port1 line and observe which switch port signals a link down. This way, traffic will only be dropped for the duration of this action and not for the (longer) period of one or possibly two HA cluster failovers.

A different approach would be to observe how much traffic flows across each switch port. The slave's wan port will not carry much traffic so the traffic rate on both switchports should be different by a large extent.