Configuring geo-redundant HA with VRRP failover
In the following scenario, HA with VRRP failover is configured for two FortiManager devices in different geographic areas for geo-redundancy using Layer 3.
In this example, FortiManager-A is on the 198.51.100.0/24 subnet and FortiManager-B is on the 203.0.113.0/24 subnet.
This topic includes the following sections:
Configure geo-redundant FortiManager HA with VRRP failover
To configure geo-redundant HA with VRRP failover:
-
Configure the HA settings on FortiManager-A.
-
On FortiManager-A, go to System Settings > HA.
-
Configure the Cluster Settings as follows, and click Apply.
Failover Mode VRRP Peer IP and Peer SN Choose the following:
-
IP Type:
IPv4 -
Peer IP: Enter the IP address of FortiManager-B (example,
203.0.113.1) -
Peer SN: Enter the serial number of the peer device.
VIP Enter the VIP address for the cluster (example,
192.0.2.1).This is a dummy IP and will not be used for deployment or management.
The VIP IP MUST be identical in all peers.
VRRP Interface
Choose the VRRP interface (example,
port1).Priority
200Unicast
On.
In Geo-HA it is mandatory to use Unicast as peers will not be in the same Layer2.
-
-
-
Configure the HA settings on FortiManager-B.
-
On FortiManager-B device, go to System Settings > HA.
-
Configure the Cluster Settings as follows, and click Apply.
Failover Mode VRRP Peer IP and Peer SN Choose the following:
-
IP Type:
IPv4 -
Peer IP: Enter the IP address of FortiManager-A (example,
198.51.100.1). -
Peer SN: Enter the serial number of the peer device.
VIP Enter the VIP address for the cluster (example,
192.0.2.1).This is a dummy IP and will not be used for deployment or management.
The VIP IP MUST be identical in all peers.
VRRP Interface
Choose the VRRP interface (example,
port1).Priority
100Unicast
On.
In Geo-HA it is mandatory to use Unicast as peers will not be in the same Layer2.
-
-
Verifying the HA status
To verify the HA status:
-
Access both FortiManager-A and FortiManager-B.
-
Using the GUI, you can view the HA Status on the top-right corner of each FortiManager and from System Settings > HA.
-
Using the CLI, you can run the following commands to get additional information about the HA status:
Command
Description
get system ha-statusPrint the HA status. diagnose ha statsDiagnose the HA status. diagnose sniffer packet <interface> "vrrp"Perform a packet sniffer on the port used by the VRRP protocol using "vrrp" as a filter.
This command can be used to verify that the advertisements are sent using the preferred method when Unicast mode is disabled/enabled.
Additional FortiManager configuration
In this scenario, FortiManager is using 2 IP addresses (198.51.100.1 and 203.0.113.1) to manage FortiGates. It is a best practice to define all FortiManager IPs that will be used to manage FortiGates so that it is reflected in the FortiGate config system central-management settings if FortiGate is added from FortiManager.
Defining FortiManager IPs:
-
Using the FortiManager CLI, you can run the following configuration:
config system admin setting
set mgmt-fqdn <FQDN_1 | IP_1> <FQDN_2 | IP_2> ... <FQDN_N | IP_N>
end
You can add up to a total of 10 IP addresses or FQDNs to the
mgmt-fqdnattribute. -
For example, in this scenario it will be as follows:
config system admin setting
set mgmt-fqdn 198.51.100.1 203.0.113.1
end
Adding a managed FortiGate to the FortiManager cluster
To onboard using the FortiManager Device Manager:
-
On FortiManager-A, go to Device Manager > Device & Groups > Managed FortiGate.
-
Click Add Device > Discover Device.
-
Enable Use Legacy Device Login and enter the device IP Address, User Name, and Password.
-
Click Next, Next, and Import Later.
-
Run the
show system central-managementcommand in the FortiGate CLI to check the management IP addresses:show system central-management
config system central-management
set type fortimanager
set fmg "198.51.100.1" "203.0.113.1"
end
The IP addresses shown should reflect the IP addresses and FQDNs configured in FortiManager under
config system admin settingas explained in the previous section.
To onboard using the Central Management connector on FortiGate:
-
On FortiGate, go to Security Fabric > Fabric Connectors > Central Management.
-
Under IP/Domain, click the + button to add more IP addresses.
-
Enter all of the FortiManager IP addresses and click OK.
For example, in this scenario the IPs are198.51.100.1and203.0.113.1. -
You can authorize the device using the dialog from the FortiGate or from the Device Manager on the Primary FortiManager.
-
Run
show system central-managementin the FortiGate CLI to check the management IP addresses. For example:show system central-management
config system central-management
set type fortimanager
set fmg "198.51.100.1" "203.0.113.1"
end
The IP addresses displayed should match those configured in step 2.
Testing VRRP failover
To test the failover configuration:
- On the FortiGate, run the following command in the CLI:
get system central-management
In the serial-number field, the serial numbers for both FortiManager-A and FortiManager-B are listed. FortiManager-A is listed first because it is currently acting as the Primary device.
-
In the CLI for FortiManager-A, run
diagnose ha force-vrrp-electionwhich will trigger failover to the FortiManager with the next highest priority. -
Refresh the page and you will notice that the HA status of FortiManager-A becomes Secondary.
-
Go to FortiManager-B, and confirm that the HA status has changed to Primary.
-
Enter the following command in the CLI to confirm the status of FortiManager-A. FortiManager-A continues to act as the Secondary device until the next VRRP election occurs.
diagnose ha stats
-
On the FortiGate, run the following command in the CLI.
get system central-management
In the serial-number field, the serial numbers for both FortiManager-A and FortiManager-B are listed. FortiManager-B will be listed first because it is now acting as the Primary device.