Show page

Differences

This shows you the differences between two versions of the page.

--- sred:lab8 [2021/01/15 18:07]
horia.stoenescu [Lab infra]
+++ sred:lab8 [2022/12/16 19:18] (current)
horia.stoenescu [Lab infra]
@@ Line 1: / Line 1: @@
-======== Lab 8. Fortigate High Availability ========
+======== Lab 8. Fortigate High Availability (HA) ========
 ===== Setup =====
 ==== Story ====
-After linking branches securely using ipsec vpn connections (primary and backup), we decided to also create a local setup consisting in 2 forti devices and 2 different networks. We need to test load balancing using HA feature Active-Active and also hot standby firewall (like HSRP) using HA Active-Passive.
+After setting virtual domains on FGT device, we decided to also implement high availability (HA) on 2 machines in Active-Active mode. For this, we require to deploy a new node on the current topology and 2 switches for connecting the existing endpoints.
+HA will permit load balancing between multiple firewall instances.
 ==== Lab infra ====
-<note warning>
-Remember that on the last lab we reused the same license for each FGT (local and remote). For HA, we cannot have the same license value on both devices (as this will mean the feature will understand we have 1 device in cluster). See on point (B) details about the setup.
-</note>
 === A. New device in network: switch ===
 As we have a HA topology, we are required to have the same configuration on both firewalls and as such, a switch is required to link them to clients.
-**A1**. Go to this [[http://gns3.xyz/files/Downloads/Cisco-IOU-L2-L3-Collection-v4/bin/i86bi-linux-l2-adventerprisek9-15.2d.bin|link]] and download the switch binary '**i86bi-linux-l2-adventerprisek9-15.2d.bin**'. Scp it to your eve-ng machine with ip 10.3.0.* (remember the credentials root:student) on path **/opt/unetlab/addons/iol/bin**.
+Go to eve-ng webui and create a new node, using 'Cisco IOL' template. Keep the default config, then start it. No other configurations are required.
-Add for current eve-ng user +x:
+=== B. New firewall node: remote Fortigate machine ===
-<code>
-root@SRED:/opt/unetlab/addons/iol/bin# chmod +x i86bi-linux-l2-adventerprisek9-15.2d.bin
-</code>
-**A2**. We need now to generate a serial for switch device. Copy on the same location as above the following python script:
+The already existing firewall will be called from now **Local-FortiGate** and the new one **Remote-FortiGate**.
-<code>
-#! /usr/bin/python
-print("*********************************************************************")
-print("Cisco IOU License Generator - Kal 2011, python port of 2006 C version")
-print("Modified to work with python3 by c_d 2014")
-import os
-import socket
-import hashlib
-import struct
-# get the host id and host name to calculate the hostkey
+<note warning>
-hostid=os.popen("hostid").read().strip()
+For HA, we cannot have the same license value on both devices (as this will mean the feature will understand we have 1 device in cluster). See on Moodle the second lic file and upload it to new node. As such, each machine will have a different serial number.
-hostname = socket.gethostname()
+</note>
-ioukey=int(hostid,16)
-for x in hostname:
- ioukey = ioukey + ord(x)
-print("hostid=" + hostid +", hostname="+ hostname + ", ioukey=" + hex(ioukey)[2:])
-# create the license using md5sum
+<note important>
-iouPad1 = b'\x4B\x58\x21\x81\x56\x7B\x0D\xF3\x21\x43\x9B\x7E\xAC\x1D\xE6\x8A'
+In case you need to find the ip address for FGT, you need to go to global mode:
-iouPad2 = b'\x80' + 39*b'\0'
-md5input=iouPad1 + iouPad2 + struct.pack('!i', ioukey) + iouPad1
-iouLicense=hashlib.md5(md5input).hexdigest()[:16]
-print("\nAdd the following text to ~/.iourc:")
-print("[license]\n" + hostname + " = " + iouLicense + ";\n")
-print("You can disable the phone home feature with something like:")
-print(" echo '127.0.0.127 xml.cisco.com' >> /etc/hosts\n")
-######################################################################################
-</code>
-Then, execute it:
 <code>
-*********************************************************************
+FGT_81 # config global
-Cisco IOU License Generator - Kal 2011, python port of 2006 C version
-Modified to work with python3 by c_d 2014
-hostid=007f0101, hostname=SRED, ioukey=7f022f
-Add the following text to ~/.iourc:
+FGT_81 (root) # show system interface ?
-[license]
-SRED = eb8d7f0235852d2d;
-You can disable the phone home feature with something like:
- echo '127.0.0.127 xml.cisco.com' >> /etc/hosts
 </code>
+</note>
-Copy the SRED license with header to /opt/unetlab/addons/iol/bin/iourc file. In the end, you will need to have something like this:
+**B1**. Local-FortiGate (first FGT): save the config (admin > Configuration > Revisions > save changes > add comment 'after_vdom_config'), then revert to an old revision 'before_vdom_enabled' (from the 7th lab - VDOM, in case you have it). Wait for machine to reboot, then access it from CLI and check the ip for port1 (mgmt) as it might be changed.
-<code>
-root@SRED:/opt/unetlab/addons/iol/bin# cat iourc
-[license]
-SRED = eb8d7f0235852d2d;
-</code>
-**A3**. Go to eve-ng webui and create a new node, using 'Cisco IOL' template. Keep the default config, then start it. No other configurations are required.
-=== B. Different licenses ===
+Stop it, then connect port4 to port 4, when the node from below is created, port2 to client1 (via switch), and port3 to client2 (via switch).
-Local-FortiGate (first FGT): keep it in its current - you can save the config (admin > Configuration > Revisions > save changes > add comment 'vdom_and_ipsec') and then shut it down.
+**B2**. Remote-FortiGate (secondary FGT): create a new node with 4 interfaces, 1 vCPU, 2 GB RAM, then connect port1 to Cloud0 (already added to the topology), port2 to client1 (via switch), port3 to client2 (via switch), and port4 to Local-FGT (via port4) . Start the FGT (Remote-FortiGate), then you will need firstly to change the mac address:
-As both Local and Remote have the same license (cannot do HA in this case), create a new FGT (Local-FortiGate) instead of the old one. Change mac address for port1 to **50:00:00:byte_2_eveng_ip:byte3_eveng_ip+2:byte4_eveng_ip**:
 <code>
 # config sys int
-# edit <interface>
+# edit port1
-# set macaddr <MAC address> - use here the format: 50:00:00:byte_2_eveng_ip:byte3_eveng_ip+2:byte4_eveng_ip
+# set macaddr <MAC address> - use here the format: 50:00:00:byte_2_eveng_ip:byte3_eveng_ip+1:byte4_eveng_ip
 # end
 # exec router restart
 </code>
-And then redo all the configuration from [[https://ocw.cs.pub.ro/courses/sred/lab6#licensing|Licensing]] (ask me to upload the license - it will have a different serial number than the one from Remote-FortiGate).
+Connect to machine via browser, then upload the new license file. Do not configure port2 and port3, as their ips will be synced with the local-forti.
-After licensing, **save the configuration**: admin > Configuration > Revisions > save changes > add comment 'initial_config_FGT'.
+=== C. Network topology ===
-For Remote-FortiGate (secondary FGT), do the same: save config for ipsec (in case you may need to come back to it) and then remove any configuration made for ipsec: go to each ipsec tunnel > Ref > delete each reference (firewall policy, intf and static route).
+At last, all nodes should be connected as seen below:
-{{:sred:machines_config_lab8.png?600|}}
+{{:sred:lab9_ha.png?800|}}
-=== C. Same config on both devices ===
-In order to create the HA config, we need to have the same interface configuration for both machines:
-- for port1, keep the ip as static (we cannot have dhcp mode configured)
+==== Exercises ====
-- for port2, use network 192.168.0.0/24 (with .1 for FGT) and dhcp server starting from .2
+We are going again to use the [[https://curs.upb.ro/2022/pluginfile.php/397572/mod_folder/content/0/FortiGate_Infrastructure_6.4_Lab_Guide-Online.pdf|pdf]] file with Fortinet Exercises - go to Lab 7: High Availability (page 125).
-- for port3, use network 172.16.0.0/24 (with .1 for FGT) and dhcp server starting from .2
+=== Exercise 1 [5p] ===
-Network topology:
+For exchanging the heartbeat messages between the firewalls, use port4 (instead of port2, as stated on pdf).
-{{:sred:lab8_topology.png?800|}}
+<note important>
+Before starting doing the tasks from guide, remember these 2 rules:
+. machines need to have **different serial numbers** (so, different licenses)
-==== Exercises ====
+. the **highest** priority in a cluster wins the election (becomes the master) - there will be other priorities in other conditions, see task 2 for more details.
-We are going again to use the pdf file with Fortinet Exercises - go to Lab 7: High Availability (page 125).
+Also, after the HA cluster is established, the interface port1 will have the same static ip value on both machines (which is the ip found on primary device). There is a sync made between them and the secondary's ip is rewritten.
+</note>
-=== Task 1 ===
+<note warning>
-<note important>
+HA config also require to add a group-id (based on it, the 5th bytes of mac addreses of each interface will be changed - see more [[https://kb.fortinet.com/kb/documentLink.do?externalID=11772|here]] and configure it on both of your firewalls using the WebUI or from CLI directly:
-Before starting doing the tasks from guide, remember these 3 rules:
+<code>
+FGT81_2 # config sys ha
-. have the **same configuration** for interfaces on both fortigates
+FGT81_2 (ha) # set group-id 81 # use the 4th byte of your eveng ipv4 address
+FGT81_2 (ha) # end
-. machines need to have **different serial numbers** (so, different licenses)
+</code>
-. the **highest** priority in a cluster wins the election (becomes the master) - there will be other priorities in other conditions, see task 2 for more details.
 </note>
 At the end, on the remote FGT (that with priority 100), you will see the following:
@@ Line 144: / Line 100: @@
 For session statistics, ping from each client the other one.
-=== Task 2 ===
+=== Exercise 2 [4p] ===
 For failover triggering, we cannot ping external ip or access youtube website (due to blackhole for def route) and instead, ping with delay of 1 sec client2 from client2:
@@ Line 158: / Line 114: @@
 {{:sred:ex2_failover.png?800|}}
-=== Task 3 ===
+=== Exercise 3 [1p] ===
-Look here only over the first part (access secondary fortigate via CLI).
+Look here only over the first part (access secondary fortigate remotely via CLI).