Helpful ReplyHot!Active-Active HA Problem (Slave device is unreachable)

Author
farhang.gh@gmail.com
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/12/06 03:01:40
  • Status: offline
2018/12/09 01:48:03 (permalink)
0

Active-Active HA Problem (Slave device is unreachable)

Dear guys,
We have two FortiGate 300E in an active-active cluster. HA port is up, configuration sync is OK and everything looks fine.
But the slave device is unreachable. We cannot ping any interface on slave device when directly connecting the slave device to laptop. Ping reply is "destination host is unreachable".
Then I enabled load-balance-all through command line, but same result.
Do you have any suggestion?
Thanks
 
#1
ede_pfau
Expert Member
  • Total Posts : 5832
  • Scores: 423
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: Active-Active HA Problem (Slave device is unreachable) 2018/12/10 13:55:32 (permalink) ☄ Helpfulby lobstercreed 2018/12/11 17:45:52
0
On the master unit, in CLI "exec ha manage 0" - can you login (telnet) across the HA link this way?

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#2
farhang.gh@gmail.com
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/12/06 03:01:40
  • Status: offline
Re: Active-Active HA Problem (Slave device is unreachable) 2018/12/10 21:55:45 (permalink)
0
Hi,
Yes I could.
#3
farhang.gh@gmail.com
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/12/06 03:01:40
  • Status: offline
Re: Active-Active HA Problem (Slave device is unreachable) 2018/12/13 01:40:13 (permalink)
0
Any idea?
#4
rdumitrescu
Bronze Member
  • Total Posts : 35
  • Scores: 11
  • Reward points: 0
  • Joined: 2014/12/02 08:06:13
  • Status: offline
Re: Active-Active HA Problem (Slave device is unreachable) 2018/12/13 02:52:40 (permalink)
5 (1)
Hi,
 
In a A/A cluster you a have a primary unit and a subordinate unit (Slave)
The subordinate unit is not meant to process arbitrary traffic but only the sessions that are offloaded to the subordinate unit by the primary unit.
In order words, the session setup always happen on the primary unit, then the primary unit can decide to offload the session to the subordinate unit.
 
Regards
Radu
#5
farhang.gh@gmail.com
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/12/06 03:01:40
  • Status: offline
Re: Active-Active HA Problem (Slave device is unreachable) 2018/12/13 03:22:50 (permalink)
0
Hi,
Thanks for your answer, but even if I enabled load-balance-all? Or even by enabling sync packets?
In other words, no way for having two devices responsible to networks?
Thanks
#6
rdumitrescu
Bronze Member
  • Total Posts : 35
  • Scores: 11
  • Reward points: 0
  • Joined: 2014/12/02 08:06:13
  • Status: offline
Re: Active-Active HA Problem (Slave device is unreachable) 2018/12/13 07:59:00 (permalink)
0
No, you cannot have two devices that actively process traffic.
The primary unit receive the traffic and decide to load-balance to other subordinate unit if the criteria is matched.
 
For better understanding you can find all the details under the section: HA and load balancing
https://docs.fortinet.com/uploaded/files/4304/fortigate-ha-60.pdf
 
Regards
Radu
#7
lobstercreed
Silver Member
  • Total Posts : 87
  • Scores: 17
  • Reward points: 0
  • Joined: 2018/11/28 14:57:58
  • Location: Sedalia, MO
  • Status: offline
Re: Active-Active HA Problem (Slave device is unreachable) 2018/12/13 12:25:26 (permalink)
0
What you *can* do is manage them using a special management interface as mentioned here:
 
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-high-availability-52/HA_operatingReservedMg.htm
 
This is mainly so you can manage the second unit via GUI or for other monitoring(SNMP), but you can do what you need through CLI per Ede's response.
#8
Jump to:
© 2019 APG vNext Commercial Version 5.5