1

I want to create a Fortigate cluster with two Fortigate running the same frimware version. Each Fortigate has its own license, so each one has its serial number. I have configured HA links by following the steps described on Cookbook. But the routers (Salve & Master) don't synchronize. Someone might know why? o_O

Help me please!

Thanks in advance.

The configurations are:
####################Fortigate 1####################
config system ha

set group-name "Cluster"

    set mode a-p

    set password ENC YYxXRRuXdiXkbfjL...

    set hbdev "port3" 50  "port4" 50

    set session-pickup enable

    set override disable

    set monitor "port1" "port3" "port4" "port5"

end
#############################

get system ha status

Model : Fortigate-VM64

Mode: a-p

Group: 0

Debug: 0

ses_pickup: enable, ses_pickup_delay=disable

Master : 128 Fortigate1         

Number of vcluster: 1

vcluster 1 : work 168.254.0.4

Master : 0 FGVM100000XXXX

Salve : 1 FGVM100000XXYY

#############################

diagnose sys ha cluster-csum

=======================Fortigate 1 ================================

is_manage_master ()=0, is_root_master ()=0
debugzone

global : 8c db d6 fc 9a 84 bb 8d d7 10 d6 e0 a6 6f 09 7e

root : 49 f0 12 10 42 09 c7 66 aa 04 c5 2c 29 52 0f 76

all: 9e 2c a7 e5 7c 6f a6 88 e5 a9 ea 26 e6 48 69 e6


checksum

global : 8c db d6 fc 9a 84 bb 8d d7 10 d6 e0 a6 6f 09 7e

root : 49 f0 12 10 42 09 c7 66 aa 04 c5 2c 29 52 0f 76 

all: 9e 2c a7 e5 7c 6f a6 88 e5 a9 ea 26 e6 48 69 e6


####################Fortigate 2####################

config system ha

    set group-name "Cluster"

    set mode a-p

    set password ENC YYxXRRuXdiXkbfjL...

    set hbdev "port3" 50  "port4" 50

    set session-pickup enable

    set override disable

    set priority 50

    set monitor "port1" "port3" "port4" "port5" 

end

get system ha status

Model : Fortigate-VM64

Mode: a-p

Group: 0

Debug: 0

ses_pickup: enable, ses_pickup_delay=disable

Slave : 50 Fortigate2       

Number of vcluster: 1

Salve : 1 FGVM100000XXXX

Master : 0 FGVM100000XXXX


diagnose sys ha cluster-csum

=======================Fortigate 2 ================================

is_manage_master ()=0, is_root_master ()=0
debugzone

global : 0f d4 37 ca f2 7e 5b ff ca fb ac aa 8b 38 88 6d

root : 1c 85 55 fe a7 e5 7c 6f a6 88 e5 a9 ea 26 e6 92

all: f5 62 b2 ce 81 9a c9 04 8f 67 07 ec a7 44 60 1f


checksum

global : 0f d4 37 ca f2 7e 5b ff ca fb ac aa 8b 38 88 6d

root : 1c 85 55 fe a7 e5 7c 6f a6 88 e5 a9 ea 26 e6 92

all: f5 62 b2 ce 81 9a c9 04 8f 67 07 ec a7 44 60 1f
  • 1
    We can't help you without configurations, log messages, etc. Please include them in your post. – Teun Vink Apr 24 '17 at 14:00
  • Is promiscuous mode for VMs enabled? – ar_ Apr 24 '17 at 15:14
  • I forgot that! Thank you very much for you help :) – MicaLyl Apr 25 '17 at 12:11
  • I configrued promiscious mode and when I teste the cluster, the Fortigates don't synchronize AGAIN!!! o_O – MicaLyl Apr 26 '17 at 9:07
1

Configure a Cluster of Fortigate VM Step by Step:

First, when you configure a Cluster of two Fortigate VM you have to :

  • On VMware, the two routers are linked via vSwitch, make sure that the VMs are linked.
  • Enable a promicsious mode on vSwitch to permit HA communication between the HA interfaces, following this steps:

    1.In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane.
    2.In Hardware, select Networking.
    3.Select Properties of a vSwitch used to connect heartbeat interfaces.
    4.In the Properties window left pane, select vSwitch and then select Edit.
    5.Select the Security tab, set Promiscuous Mode to Accept, then select OK.
    6.Select Close.
    
  • When we creat a virtual machine with one or more virtual network adapter, two MAC address are generated automatically for each virtual adapter.

    • The first one is called initial MAC address and is stored on configuration file. This can not be changed.
    • The seconde one is effective MAC address, which is configured by guest operating system and used as the source MAC address during a communication with other system. The effective MAC address, however, can be changed on vSwitch.

Because FGCP set a virtual MAC address to the same interfaces on Fortigates, you have to:

  • Set the vSwitch to accept the MAC address changes: to allow traffic to be passed through the vSwitch to virtual marchine if the initial and effective address do not match (Incomming traffic)

  • Set the vSwitch to accept forged transmit: cause when this is on "Accept", ESXi don't compare the initial MAC address with effective MAC address when sending paquets. So the paquets don't be rejected by the hypervisor (outgoing traffic)

    Follow this steps to do it :

1.In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane.
      2.In Hardware, select Networking.
      3.Select Properties of a vSwitch used to connect heartbeat interfaces.
      4.In the Properties window left pane, select vSwitch and then select Edit.
      5.Select the Security tab, set MAC address change to "Accept" and Forged transmit to "Accept".
      6.Select OK and Close.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.