Configuring the FortiControllers
-
Connect to the GUI (using HTTPS) or CLI (using SSH) of the FortiController in slot 1 using the default IP address 192.168.1.99.
Or connect to the FortiController CLI through the console port (Baud Rate 9600bps, Data bits 8, Parity None, Stop bits 1, and Flow Control None).
- Login using the admin administrator account and no password.
-
Add a password for the admin administrator account. From the GUI use the Administrators widget or from the CLI enter this command.
config admin user
edit admin
set password <password>
end
-
Change the FortiController mgmt interface IP address.
From the GUI use the Management Port widget or from the CLI enter this command:
config system interface
edit mgmt
set ip 172.20.120.151/24
end
-
If you need to add a default route for the management IP address, enter this command.
config route static
edit route 1
set gateway 172.20.120.2
end
-
Set the chassis type that you are using, for example:
config system global
set chassis-type fortigate-5140
end
- Configure dual Mode HA on the FortiController in slot 1. From the FortiController GUI System Information widget, beside HA Status select Configure.
-
Set Mode to Dual Mode, change the Group ID, and move the b1 and b2 interfaces to the Selected column and select OK.
You can also enter this CLI command:
config system ha
set mode dual
set groupid 4
set hbdev b1 b2
end
If you have more than one cluster on the same network, each cluster should have a different Group ID. Changing the Group ID changes the cluster interface virtual MAC addresses. If your group ID setting causes a MAC address conflict you can select a different Group ID. The default Group ID of 0 is not a good choice and normally should be changed.
You can also adjust other HA settings. For example, you could increase the Device Priority of the FortiController that you want to become the primary unit, or enable Override to make sure the FortiController with the highest device priority becomes the primary unit.
If the heartbeat interfaces are connected using a switch, you can change the VLAN to use for HA heartbeat traffic if it conflicts with a VLAN on the switch.
You would only select Enable chassis redundancy if you are configuring HA between two chassis.
-
Log into the GUI of the FortiController in slot 2 and duplicate the HA configuration of the FortiController in slot 1, except for the Device Priority and override setting, which can be different on each FortiController.
After a short time, the FortiControllers restart in HA mode and form a dual mode cluster. Both FortiControllers must have the same HA configuration (aside from device priority and override) and at least one heartbeat link must be connected.
Normally the FortiController in slot 1 is the primary unit, and you can log into the cluster using the management IP address you assigned to this FortiController.
If the FortiControllers are unable to form a cluster, check to make sure that they both have the same HA configuration. Also they can't form a cluster if the heartbeat interfaces (B1 and B2) are not connected.
-
Confirm that cluster has been formed by viewing HA configuration from the FortiController GUI. The display should show both FortiControllers in the cluster.
Since the configuration of the FortiControllers is synchronized, you can complete the configuration of the cluster from the primary FortiController.
-
Go to Load Balance > Status to see the status of the cluster. This page should show both FortiControllers in the cluster.
Since both FortiControllers are active, their slot icons both appear green on the GUI.
-
Go to Load Balance > Config to add the workers to the cluster by selecting Edit and moving the slots that contain workers to the Members list.
The Config page shows the slots in which the cluster expects to find workers. If the workers have not been configured yet their status will be Down.
-
Configure the External Management IP/Netmask. Once you have connected workers to the cluster, you can use this IP address to manage and configure them.
-
You can also enter the following CLI command to add slots 3, 4, and 5 to the cluster:
config load-balance setting
config slots
edit 3
next
edit 4
next
edit 5
end
end
You can also use the following CLI command to configure the external management IP/Netmask and management access to this address:
config load-balance setting
set base-mgmt-external-ip 172.20.120.100 255.255.255.0
set base-mgmt-allowaccess https ssh ping
end
- Configure the External Management IP/Netmask. Once you have connected workers to the cluster, you can use this IP address to manage and configure them.
-
Configure the External Management IP/Netmask. Once you have connected workers to the cluster, you can use this IP address to manage and configure them.
You can also enter the following CLI command to add slots 3, 4, and 5 to the cluster:
config load-balance setting
config slots
edit 3
next
edit 4
next
edit 5
end
end
You can also use the following CLI command to configure the external management IP/Netmask and management access to this address:
config load-balance setting
set base-mgmt-external-ip 172.20.120.100 255.255.255.0
set base-mgmt-allowaccess https ssh ping
end
-
Enable base management traffic between FortiControllers. The CLI syntax shows setting the default base management VLAN (101). You can also use this command to change the base management VLAN.
config load-balance setting
config base-mgmt-interfaces
edit b1
set vlan-id 101
next
edit b2
set vlan-id 101
end
end
-
Enable base control traffic between FortiControllers. The CLI syntax shows setting the default base control VLAN (301). You can also use this command to change the base management VLAN.
config load-balance setting
config base-ctrl-interfaces
edit b1
set vlan-id 301
next
edit b2
set vlan-id 301
end
end