Configuring the FortiGate-5000 active-active cluster - CLI
These procedures assume you are starting with three FortiGate-5001C boards and two FortiSwitch-5003B boards installed in a compatible FortiGate-5000 series chassis. The FortiSwitch-5003B boards are in chassis slots 1 and 2 and the FortiGate-5001C boards are in chassis slots 3, 4, and 5 and the chassis is powered on. All devices are in their factory default configuration. No configuration changes to the FortiSwitch-5003B boards are required.
To configure the FortiGate-5005FA2 units
1. From the internal network, log into the CLI of the FortiGate-5001C unit in chassis slot 3 by connecting to the mgmt1 interface.
| By default the mgmt1 interface of each FortiGate-5001C unit has the same IP address. To log into each FortiGate-5001C unit separately you could either disconnect the mgmt1 interfaces of the units that you don’t want to log into or change the mgmt1 interface IP addresses for each unit by connecting to each unit’s CLI from their console port. |
You can also use a console connection.
2. Change the host name for this FortiGate unit. For example:
config system global
set hostname 5001C-Slot-3
end
3. Enter the following command to display backplane interfaces on the web‑based manager:
config system global
set show-backplane-intf enable
end
4. Set the Administrative Status of the base1 and base 2 interfaces to Up.
config system interface
edit base1
set status up
next
edit base2
set status up
end
5. Add an IP address to the mgmt1 interface.
config system interface
edit mgmt1
set ip 172.20.120.110/24
set allowaccess http https ssl ping
end
Because mgmt1 will become the reserved management interface for the cluster unit each FortiGate-5001C should have a different mgmt1 interface IP address. Give the mgmt1 interface an address that is valid for the internal network. Once HA with the reserved Management interface is enabled the IP address of the mgmt1 interface can be on the same subnet as the port2 interface (which will also be connected to the Internal network).
6. Configure HA settings.
config system ha
set mode a-a
set ha-mgmt-status enable
set ha-mgmt-interface mgmt1
set group-name example3.com
set password HA_pass_3
set hbdev base1 50 base2 50 mgmt2 50
end
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and the FGCP changes the MAC address of the FortiGate unit interfaces (see
“Cluster virtual MAC addresses”). The MAC addresses of the FortiGate‑5001C interfaces change to the following virtual MAC addresses:
• base1 interface virtual MAC: 00-09-0f-09-00-00
• base2 interface virtual MAC: 00-09-0f-09-00-01
• fabric1 interface virtual MAC: 00-09-0f-09-00-02
• fabric2 interface virtual MAC: 00-09-0f-09-00-03
• fabric3 interface virtual MAC: 00-09-0f-09-00-04
• fabric4 interface virtual MAC: 00-09-0f-09-00-05
• fabric5 interface virtual MAC: 00-09-0f-09-00-06
• mgmt1 keeps its original MAC address
• mgmt2 interface virtual MAC: 00-09-0f-09-00-08
• port1 interface virtual MAC: 00-09-0f-09-00-09
• port2 interface virtual MAC: 00-09-0f-09-00-0a
To reconnect sooner, you can update the ARP table of your management PC by deleting the ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able to delete the arp table of your management PC from a command prompt using a command similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI command to view the virtual MAC address of any FortiGate unit interface. For example, use the following command to view the port1 interface virtual MAC address (Current_HWaddr) and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic base1
.
.
.
Current_HWaddr 00:09:0f:09:00:00
Permanent_HWaddr 00:09:0f:71:0a:dc
.
.
.
7. Repeat these steps for the FortiGate-5001C units in chassis slots 4 and 5, with the following differences.
Set the mgmt1 interface IP address of each FortiGate-5001C unit to a different IP address.
Set the FortiGate-5001C unit in chassis slot 4 host name to:
config system global
set hostname 5001C-Slot-4
end
Set the FortiGate-5001C unit in chassis slot 5 host name to:
config system global
set hostname 5001C-Slot-5
end
As you configure each FortiGate unit, they will negotiate and join the cluster.
To view cluster status
As you add units to the cluster you can log into the CLI of one of the cluster units using its reserved management interface to view the status of the cluster. The status will show each unit as it is added to the cluster.
For example, the following command output shows the status of the cluster when all three cluster units have been added:
get system ha status
Model: FortiGate-5001C
Mode: a-a
Group: 0
Debug: 0
ses_pickup: disable
Master:128 slot-5 FG-5KC3E13800084 0
Slave :128 slot-4 FG-5KC3E13800051 1
Slave :128 slot-3 FG-5KC3E13800046 2
number of vcluster: 1
vcluster 1: work 169.254.0.1
Master:0 FG-5KC3E13800084
Slave :1 FG-5KC3E13800051
Slave :2 FG-5KC3E13800046
You can use this command to confirm that the cluster is operating normally. For example, if the command shows only two cluster units then one unit has left the cluster for some reason.
To troubleshoot the cluster
To manage each cluster unit
Because you have configured a reserved management interface, you can manage each cluster unit separately by connecting to the IP address you configured for each unit’s mgmt1 interface. You can view the status of each cluster unit and make changes to each unit’s configuration. For example, as described below, each cluster unit must have its own FortiClient license. You can use the reserved management IP addresses to connect to each cluster unit to install the FortiClient license for that unit.
Usually you would make configuration changes by connecting to the primary unit and changing its configuration. The cluster then synchronizes the configuration changes to all cluster units. If you connect to individual cluster units and change their configuration, those configuration changes are also synchronized to each cluster unit. The exception to this is configuration objects that are not synchronized, such as the host name, FortiClient license and so on.
You can also manage each cluster unit by logging into the primary unit CLI and using the following command to connect to other cluster units:
execute ha manage <cluster-index>
To add a password for the admin administrative account
1. Add a password for the admin administrative account.
config system admin
edit admin
set password <psswrd>
end
To add basic configuration settings to the cluster
Use the following steps to configure the cluster.
1. Log into the cluster CLI.
You can log into the primary unit or any one of the cluster units using the appropriate mgmt1 IP address.
2. Add a password for the admin administrative account.
config system admin
edit admin
set password <psswrd>
end
3. Set the port1 interface IP address to the address required to connect to the interface to the Internet.
config system interface
edit port1
set ip 10.10.10.10/24
end
4. Set the port2 interface IP address to the address required to connect to the interface to the internal network.
config system interface
edit port2
set ip 172.20.120.12/24
end
To add a FortiClient license to each cluster unit
Contact your reseller to purchase FortiClient licenses for your cluster units. Each cluster unit must have its own FortiClient license.
When you receive the license keys you can log into
https://support.fortinet.com and add a FortiClient license key to each licensed FortiGate unit. Then, as long as the cluster can connect to the Internet the license keys are downloaded from the FortiGuard network to all of the FortiGate units in the cluster.
You can also use the following steps to manually add the license keys to your cluster units from the CLI. Your cluster must be connected to the Internet.
1. Log into the CLI of each cluster unit using its reserved management interface IP address.
2. Enter the following command to the unit’s serial number:
get system status
3. Enter the following command to add the license key for that serial number:
execute FortiClient-NAC update-registration-license <license-key>
4. Confirm that the license has been installed and the correct number of FortiClients are licensed.
execute forticlient info
Maximum FortiClient connections: unlimited.
Licensed connections: 114
NAC: 114
WANOPT: 0
Test: 0
Other connections:
IPsec: 0
SSLVPN: 0
5. Repeat for all of the cluster units.
You can also log into the primary unit CLI and use the execute ha manage command to connect to each cluster unit CLI.