Fortinet black logo

OCI Administration Guide

Checking the HA status and function

Copy Link
Copy Doc ID dafbe0b4-44e9-11e9-94bf-00505692583a:432722
Download PDF

Checking the HA status and function

To check the HA status and function:
  1. In FortiOS on the primary FortiGate, go to System > HA. Check that the HA status is synchronized.

  2. Create one PC in the internal subnet located in AD1, and another PC in the internal subnet located in AD2. Verify that both PCs can access the Internet via FGT-A-AD1, the current primary node.
  3. Shut down FGT-A-AD1.
  4. Verify that FGT-B-AD2 becomes the primary FortiGate.
  5. Use an API call to verify that the internal routing table's next hop changed from FGT-A-AD1's internal NIC address (10.0.12.21) to FGT-B-AD2's internal NIC address (10.0.22.22) and that the EIP address attached to FGT-A-AD1's external NIC reattached to FGT-B-AD2's external NIC. You can also use the following diagnose command:

    FGT-B-AD2 # d deb app ocid -1 Debug messages will be on for 30 minutes. FGT-B-AD2 # d deb en FGT-B-AD2 # HA event Become HA master mode 2 Getting oci meta-token ocid api url: https://auth.us-ashburn-1.oraclecloud.com/v1/x509 ocid collect public ip from OCI ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/publicIps?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&scope=REGION&lifetime=RESERVED&limit=1000 ocid collect vnics info for instance FGT-B ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/vnicAttachments?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&instanceId=ocid1.instance.oc1.iad.abuwcljsdd24ejpo2pvzdtoltfvuil4ss6w2md7k6gc66xzt222546ygc7la vnic id(1/4): ocid1.vnic.oc1.iad.abuwcljs76qzu6gmevtzpvl2xpaih3cq6atcvyxbvywezp2rwhdlk6xfhvza ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljs76qzu6gmevtzpvl2xpaih3cq6atcvyxbvywezp2rwhdlk6xfhvza vnic id(2/4): ocid1.vnic.oc1.iad.abuwcljsdka5z6qukwhaeemg5uxn4zqiaksp3gqyezdisxcvvveczcy2di5a ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljsdka5z6qukwhaeemg5uxn4zqiaksp3gqyezdisxcvvveczcy2di5a vnic id(3/4): ocid1.vnic.oc1.iad.abuwcljsoict6e4i3rr4vzl25ogims22b26khe2kroywwdre5ybuvmxqjswq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljsoict6e4i3rr4vzl25ogims22b26khe2kroywwdre5ybuvmxqjswq vnic id(4/4): ocid1.vnic.oc1.iad.abuwcljs72l3az24q4ellxxde7533bcvz6tebfdzzmi2henh4acwrpl5kjbq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljs72l3az24q4ellxxde7533bcvz6tebfdzzmi2henh4acwrpl5kjbq instance: FGT-B vnic: 10.0.24.22(129.213.188.144) vnic: 10.0.21.22 vnic: 10.0.22.22 vnic: 10.0.23.22 ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/subnets/ocid1.subnet.oc1.iad.aaaaaaaaz5htioi34gbwpm4ib6t54lhdsmwlp6gpwygo4joy2zqhtc4jzswq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/subnets?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&vcnId=ocid1.vcn.oc1.iad.aaaaaaaa5dfd4ud7pceb5uykemraiddojlgk3qsibvm2sectfvmpeuta73ha ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaajjdbd62mq2kqfy7ncjada5i4pvnfyuuwrwqri763illanlyh3y3a ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaaz5htioi34gbwpm4ib6t54lhdsmwlp6gpwygo4joy2zqhtc4jzswq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaagypiubrwowu4cy3khyo23uxqcnrftdizqzmbrdwpx2qoxediub2q ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaalk3n5o74urfjbg5q77owicsahhc34fjdsmlyq5r7auuzpbhknj7a ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaaep4y5zoaotwpjlyrxtvucrkshappytdw2ktdw5kwpplykg2h57ya ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaafn3wl6kuh5fbaqsggfezgxkhqagduo2lxw6my5wb4hrywd7s73fq ocid found peer heart beat ip 10.0.13.21 in subnet net13-heartbeat ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/vnicAttachments?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&vnicId=ocid1.vnic.oc1.iad.abuwcljtqtujnevzbifkcvv6c4itt3xmrn6gr57qps2v2w7ccwfrijrdmkhq ocid collect vnics info for peer instance ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/vnicAttachments?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&instanceId=ocid1.instance.oc1.iad.abuwcljt5zkznwtdirurbeqhpeuh5ktcizg2srdn6segjebphejscoj2y6la vnic id(1/4): ocid1.vnic.oc1.iad.abuwcljtqtujnevzbifkcvv6c4itt3xmrn6gr57qps2v2w7ccwfrijrdmkhq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljtqtujnevzbifkcvv6c4itt3xmrn6gr57qps2v2w7ccwfrijrdmkhq vnic id(2/4): ocid1.vnic.oc1.iad.abuwcljt5aj42rcy6yrpmfmhem7wiboiargdlvdfnskg5jkqc426gukhavdq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljt5aj42rcy6yrpmfmhem7wiboiargdlvdfnskg5jkqc426gukhavdq vnic id(3/4): ocid1.vnic.oc1.iad.abuwcljtzdqf5rhpvcbhzm7gxgvmzu5xm34eo6kiaxtea5l5f4qwhskw6nbq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljtzdqf5rhpvcbhzm7gxgvmzu5xm34eo6kiaxtea5l5f4qwhskw6nbq vnic id(4/4): ocid1.vnic.oc1.iad.abuwcljtpw6tkr3jevqd52b3sg4f5rkzqoyd4zegimdqkqa4ualwe5cnat4q ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljtpw6tkr3jevqd52b3sg4f5rkzqoyd4zegimdqkqa4ualwe5cnat4q instance: vnic: 10.0.14.21(129.213.181.141) vnic: 10.0.11.21(129.213.191.163) vnic: 10.0.12.21 vnic: 10.0.13.21 checking ip: 10.0.21.22 in port2 ocid failover public ip 129.213.191.163 from 10.0.11.21 to 10.0.21.22 ocid updating public ip 129.213.191.163 with data: {"privateIpId": "ocid1.privateip.oc1.iad.abuwcljsvgcf5narv2qgmbc5djv43qci6heja3lxamtch24qhp5vzizwbsna"} ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/publicIps/ocid1.publicip.oc1.iad.aaaaaaaaucxuvfvi2tyl222ib4mcluori5fofovq2lqkowy7eikwhaaijdnq ocid assigned public ip 129.213.191.163 to private ip 10.0.21.22 successfully checking ip: 10.0.22.22 in port3 ocid collect route table info from vcn ocid1.vcn.oc1.iad.aaaaaaaa5dfd4ud7pceb5uykemraiddojlgk3qsibvm2sectfvmpeuta73ha ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/routeTables?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&vcnId=ocid1.vcn.oc1.iad.aaaaaaaa5dfd4ud7pceb5uykemraiddojlgk3qsibvm2sectfvmpeuta73ha route table: rtb-internal rule: 0.0.0.0/0, next hop: 10.0.12.21 ocid update next hop from 10.0.12.21 to 10.0.22.22 in route table rtb-internal ocid updating route table rtb-internal with data: {"routeRules": [{"destination": "0.0.0.0/0", "destinationType": "CIDR_BLOCK", "networkEntityId": "ocid1.privateip.oc1.iad.abuwcljstkyb7gvv5lyrf3ugb4mqbmmugijl6zpcbtr2cht4tsggqlq6e4fq"}]} ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/routeTables/ocid1.routetable.oc1.iad.aaaaaaaapxqqkjnznvkqvhcbghotxzfzy7umjgg4jtg7z6o2s5dcmjsmmmta ocid update route table rtb-internal successfully HA event

  6. Log into both PCs created in step 2. Verify that each PC can access the Internet via FGT-B-AD2, the new primary node.

Checking the HA status and function

To check the HA status and function:
  1. In FortiOS on the primary FortiGate, go to System > HA. Check that the HA status is synchronized.

  2. Create one PC in the internal subnet located in AD1, and another PC in the internal subnet located in AD2. Verify that both PCs can access the Internet via FGT-A-AD1, the current primary node.
  3. Shut down FGT-A-AD1.
  4. Verify that FGT-B-AD2 becomes the primary FortiGate.
  5. Use an API call to verify that the internal routing table's next hop changed from FGT-A-AD1's internal NIC address (10.0.12.21) to FGT-B-AD2's internal NIC address (10.0.22.22) and that the EIP address attached to FGT-A-AD1's external NIC reattached to FGT-B-AD2's external NIC. You can also use the following diagnose command:

    FGT-B-AD2 # d deb app ocid -1 Debug messages will be on for 30 minutes. FGT-B-AD2 # d deb en FGT-B-AD2 # HA event Become HA master mode 2 Getting oci meta-token ocid api url: https://auth.us-ashburn-1.oraclecloud.com/v1/x509 ocid collect public ip from OCI ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/publicIps?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&scope=REGION&lifetime=RESERVED&limit=1000 ocid collect vnics info for instance FGT-B ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/vnicAttachments?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&instanceId=ocid1.instance.oc1.iad.abuwcljsdd24ejpo2pvzdtoltfvuil4ss6w2md7k6gc66xzt222546ygc7la vnic id(1/4): ocid1.vnic.oc1.iad.abuwcljs76qzu6gmevtzpvl2xpaih3cq6atcvyxbvywezp2rwhdlk6xfhvza ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljs76qzu6gmevtzpvl2xpaih3cq6atcvyxbvywezp2rwhdlk6xfhvza vnic id(2/4): ocid1.vnic.oc1.iad.abuwcljsdka5z6qukwhaeemg5uxn4zqiaksp3gqyezdisxcvvveczcy2di5a ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljsdka5z6qukwhaeemg5uxn4zqiaksp3gqyezdisxcvvveczcy2di5a vnic id(3/4): ocid1.vnic.oc1.iad.abuwcljsoict6e4i3rr4vzl25ogims22b26khe2kroywwdre5ybuvmxqjswq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljsoict6e4i3rr4vzl25ogims22b26khe2kroywwdre5ybuvmxqjswq vnic id(4/4): ocid1.vnic.oc1.iad.abuwcljs72l3az24q4ellxxde7533bcvz6tebfdzzmi2henh4acwrpl5kjbq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljs72l3az24q4ellxxde7533bcvz6tebfdzzmi2henh4acwrpl5kjbq instance: FGT-B vnic: 10.0.24.22(129.213.188.144) vnic: 10.0.21.22 vnic: 10.0.22.22 vnic: 10.0.23.22 ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/subnets/ocid1.subnet.oc1.iad.aaaaaaaaz5htioi34gbwpm4ib6t54lhdsmwlp6gpwygo4joy2zqhtc4jzswq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/subnets?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&vcnId=ocid1.vcn.oc1.iad.aaaaaaaa5dfd4ud7pceb5uykemraiddojlgk3qsibvm2sectfvmpeuta73ha ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaajjdbd62mq2kqfy7ncjada5i4pvnfyuuwrwqri763illanlyh3y3a ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaaz5htioi34gbwpm4ib6t54lhdsmwlp6gpwygo4joy2zqhtc4jzswq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaagypiubrwowu4cy3khyo23uxqcnrftdizqzmbrdwpx2qoxediub2q ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaalk3n5o74urfjbg5q77owicsahhc34fjdsmlyq5r7auuzpbhknj7a ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaaep4y5zoaotwpjlyrxtvucrkshappytdw2ktdw5kwpplykg2h57ya ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?ipAddress=10.0.13.21&subnetId=ocid1.subnet.oc1.iad.aaaaaaaafn3wl6kuh5fbaqsggfezgxkhqagduo2lxw6my5wb4hrywd7s73fq ocid found peer heart beat ip 10.0.13.21 in subnet net13-heartbeat ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/vnicAttachments?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&vnicId=ocid1.vnic.oc1.iad.abuwcljtqtujnevzbifkcvv6c4itt3xmrn6gr57qps2v2w7ccwfrijrdmkhq ocid collect vnics info for peer instance ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/vnicAttachments?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&instanceId=ocid1.instance.oc1.iad.abuwcljt5zkznwtdirurbeqhpeuh5ktcizg2srdn6segjebphejscoj2y6la vnic id(1/4): ocid1.vnic.oc1.iad.abuwcljtqtujnevzbifkcvv6c4itt3xmrn6gr57qps2v2w7ccwfrijrdmkhq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljtqtujnevzbifkcvv6c4itt3xmrn6gr57qps2v2w7ccwfrijrdmkhq vnic id(2/4): ocid1.vnic.oc1.iad.abuwcljt5aj42rcy6yrpmfmhem7wiboiargdlvdfnskg5jkqc426gukhavdq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljt5aj42rcy6yrpmfmhem7wiboiargdlvdfnskg5jkqc426gukhavdq vnic id(3/4): ocid1.vnic.oc1.iad.abuwcljtzdqf5rhpvcbhzm7gxgvmzu5xm34eo6kiaxtea5l5f4qwhskw6nbq ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljtzdqf5rhpvcbhzm7gxgvmzu5xm34eo6kiaxtea5l5f4qwhskw6nbq vnic id(4/4): ocid1.vnic.oc1.iad.abuwcljtpw6tkr3jevqd52b3sg4f5rkzqoyd4zegimdqkqa4ualwe5cnat4q ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/privateIps?vnicId=ocid1.vnic.oc1.iad.abuwcljtpw6tkr3jevqd52b3sg4f5rkzqoyd4zegimdqkqa4ualwe5cnat4q instance: vnic: 10.0.14.21(129.213.181.141) vnic: 10.0.11.21(129.213.191.163) vnic: 10.0.12.21 vnic: 10.0.13.21 checking ip: 10.0.21.22 in port2 ocid failover public ip 129.213.191.163 from 10.0.11.21 to 10.0.21.22 ocid updating public ip 129.213.191.163 with data: {"privateIpId": "ocid1.privateip.oc1.iad.abuwcljsvgcf5narv2qgmbc5djv43qci6heja3lxamtch24qhp5vzizwbsna"} ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/publicIps/ocid1.publicip.oc1.iad.aaaaaaaaucxuvfvi2tyl222ib4mcluori5fofovq2lqkowy7eikwhaaijdnq ocid assigned public ip 129.213.191.163 to private ip 10.0.21.22 successfully checking ip: 10.0.22.22 in port3 ocid collect route table info from vcn ocid1.vcn.oc1.iad.aaaaaaaa5dfd4ud7pceb5uykemraiddojlgk3qsibvm2sectfvmpeuta73ha ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/routeTables?compartmentId=ocid1.tenancy.oc1..aaaaaaaambr3uzztoyhweohbzqqdo775h7d3t54zpmzkp4b2cf35vs55ck3a&vcnId=ocid1.vcn.oc1.iad.aaaaaaaa5dfd4ud7pceb5uykemraiddojlgk3qsibvm2sectfvmpeuta73ha route table: rtb-internal rule: 0.0.0.0/0, next hop: 10.0.12.21 ocid update next hop from 10.0.12.21 to 10.0.22.22 in route table rtb-internal ocid updating route table rtb-internal with data: {"routeRules": [{"destination": "0.0.0.0/0", "destinationType": "CIDR_BLOCK", "networkEntityId": "ocid1.privateip.oc1.iad.abuwcljstkyb7gvv5lyrf3ugb4mqbmmugijl6zpcbtr2cht4tsggqlq6e4fq"}]} ocid api url: https://iaas.us-ashburn-1.oraclecloud.com/20160918/routeTables/ocid1.routetable.oc1.iad.aaaaaaaapxqqkjnznvkqvhcbghotxzfzy7umjgg4jtg7z6o2s5dcmjsmmmta ocid update route table rtb-internal successfully HA event

  6. Log into both PCs created in step 2. Verify that each PC can access the Internet via FGT-B-AD2, the new primary node.