5

In a new customer's network I have found the following scenario:

Diagram

  • Fortigate 1 and 2 form and HA cluster in active-passive mode. The HA link is just a cable connecting them directly.
  • Racks A and B are a several meters apart and cables between them run through the ceiling. It is not possible to follow them and they are not identified: no pannels, no labels, ...
  • Port 1 of each Fortigate is connected to a switch but customer doesn't know the switch ports.
  • All switch ports are access ports in the default VLAN. Fortigate port 1 is default gateway for the subnet associated to this VLAN

In order to locate the switch ports, I considered connecting my PC in one switch, setting up an address of the subnet and ping the default gateway. Then check ARP looking for the MAC address of the default gateway and finally search for this MAC address in the CAM of both switches. However, I realized this will make me discover only the switch port connected to the active Fortigate unit.

Is there a way to track down the switch port connected to the passive Fortigate unit, without disconnecting the cable on firewall side, neither forcing a transition of the cluster active unit?

  • Fortigate HA requires static IP's - do you have the Mgmt IP for the second unit? – Network Canuck Jun 13 '13 at 22:19
  • Both units do not have separate management IPs, just share the IPs used to provide connectivity to the different networks. – Daniel Yuste Aroca Jun 13 '13 at 22:49
6

What you can do is SSH to the Active unit, then run:

execute ha manage <x>

where x is the ID of the other unit.

Then run

config system interface
edit "port1"
set status down
next 
edit "port1"
set status up
end

You can then log on to the switch (assuming it is logging interface UP/DOWNS) and see which interface went down.

  • This would allow me to discover the switch interface without disconnecting any cable (as I stated in the question) but still implies taking the firewall interface down, which I am trying to avoid. Any other suggestion? – Daniel Yuste Aroca Jun 17 '13 at 19:43
  • 1
    Why would it matter that you're taking the firewall interface down on the passive device? There's no traffic going through it. – Puglet Jun 24 '13 at 5:58
0

There is no direct way to determine the slave's MAC of port1 as both HA cluster member units share identical virtual MACs for each port.
Disconnecting (or disabling) a port has a 50% chance of triggering a cluster failover, with subsequently dropping some traffic.

To minimize network interruption I'd disable port monitoring for port1 temporarily, in the HA config setup. Then pull one port1 line and observe which switch port signals a link down. This way, traffic will only be dropped for the duration of this action and not for the (longer) period of one or possibly two HA cluster failovers.

A different approach would be to observe how much traffic flows across each switch port. The slave's wan port will not carry much traffic so the traffic rate on both switchports should be different by a large extent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.