Testing and troubleshooting

To optionally create an Ubuntu PC that can access the Internet via the FortiGates HA, edit and run the following commands in GCP:

To test FortiGate-VM HA:

1. Ensure that the HA status is in-sync and that the public external IP address is attached to the primary FortiGate:

   HA Health Status: OK
   Model: FortiGate-VM64-GCP
   Mode: HA A-P
   Group: 21
   Primary selected using:
       <2022/11/24 13:48:45> vcluster-1: FGVM4VTM22xxxxxx is selected as the primary because its override priority is larger than peer member FGVM4VTM22xxxxx.
   ses_pickup: enable, ses_pickup_delay=disable
   override: enable
   unicast_hb: peerip=10.0.3.11, myip=10.0.3.10, hasync_port='port3'
   Configuration Status:
       FGVM4VTM22xxxxxx(updated 4 seconds ago): in-sync
       FGVM4VTM22xxxxxx(updated 1 seconds ago): in-sync
   Primary     : fortigate-a     , FGVM4VTM22xxxxxx, HA cluster index = 0
   Secondary   : fortigate-b     , FGVM4VTM22xxxxxx, HA cluster index = 1
   number of vcluster: 1
   vcluster 1: work 10.0.3.10
   Primary: FGVM4VTM22xxxxxx, HA operating index = 0
   Secondary: FGVM4VTM220xxxxx, HA operating index = 1 

   

2. Log in to the Ubuntu PC if created.
3. Verify that the PC can access the Internet via FortiGate A, since FortiGate A is the primary FortiGate. Verify that the route-internal route gateway is set as 10.0.2.10, the FortiGate A IP address.

   

4. Shut down FortiGate A.
5. Verify that FortiGate B is now the primary FortiGate.
6. Using an API call, ensure that the route-internal route was removed and replaced with a new one, which has set the gateway as 10.0.2.11, the FortiGate B IP address.

   

7. Verify that the public IP address has detached from FortiGate A and attached to FortiGate B.
8. Log in to the PC.
9. Verify that the PC can access the Internet via FortiGate B, since FortiGate B is now the primary FortiGate.

To run diagnose commands:

After FortiGate A is shut down and FortiGate B becomes the new primary FortiGate, run the following diagnose command to see what happened to the route and public external IP address during the failover procedure:

FGT-B # diagnose debug application gcpd -1

The following shows the procedure of removing the old route (route-internal) and replacing it with a new route:

failover route: protected-private-rt, move next hop from 10.0.2.10 to 10.0.2.11

[pid 394]: failover route: protected-private-rt

[pid 394]: remove route protected-private-rt on next hop 10.0.2.10

[pid 394]: route protected-private-rt is updated to next hop 10.0.2.11 successfully.

The following shows the procedure of attaching a public external IP address to the new primary FortiGate B:

{pid 393]: nic0 of instance fortigate-a is using eip 34.135.xx8.xxx

[pid 393]: remove eip 34.135.xx8.xxx from instance fortigate-a(nic0).

[pid 393]: attach eip 34.135.xx8.xxx to instance fortigate-b(nic0).

[pid 393]: eip fgtprimaryip(34.135.xx8.xxx) is attached to local successfully.