After setting virtual domains on FGT device, we decided to also implement high availability (HA) on 2 machines in Active-Active mode. For this, we require to deploy a new node on the current topology and 2 switches for connecting the existing endpoints.

HA will permit load balancing between multiple firewall instances.

As we have a HA topology, we are required to have the same configuration on both firewalls and as such, a switch is required to link them to clients.

A1. Go to this link and download the switch binary 'i86bi-linux-l2-adventerprisek9-15.2d.bin'. Scp it to your eve-ng machine with ip 10.3.0.* (remember the credentials root:student) on path /opt/unetlab/addons/iol/bin.

A2. Add for current eve-ng user +x (otherwise the binary cannot be started):

root@SRED:/opt/unetlab/addons/iol/bin# chmod +x i86bi-linux-l2-adventerprisek9-15.2d.bin 

A3. We need now to generate a serial for switch device. Copy on the same location as above the following python script:

#! /usr/bin/python
print("*********************************************************************")
print("Cisco IOU License Generator - Kal 2011, python port of 2006 C version")
print("Modified to work with python3 by c_d 2014")
import os
import socket
import hashlib
import struct

# get the host id and host name to calculate the hostkey
hostid=os.popen("hostid").read().strip()
hostname = socket.gethostname()
ioukey=int(hostid,16)
for x in hostname:
 ioukey = ioukey + ord(x)
print("hostid=" + hostid +", hostname="+ hostname + ", ioukey=" + hex(ioukey)[2:])

# create the license using md5sum
iouPad1 = b'\x4B\x58\x21\x81\x56\x7B\x0D\xF3\x21\x43\x9B\x7E\xAC\x1D\xE6\x8A'
iouPad2 = b'\x80' + 39*b'\0'
md5input=iouPad1 + iouPad2 + struct.pack('!i', ioukey) + iouPad1
iouLicense=hashlib.md5(md5input).hexdigest()[:16]

print("\nAdd the following text to ~/.iourc:")
print("[license]\n" + hostname + " = " + iouLicense + ";\n")
print("You can disable the phone home feature with something like:")
print(" echo '127.0.0.127 xml.cisco.com' >> /etc/hosts\n")
######################################################################################

Then, execute it:

*********************************************************************
Cisco IOU License Generator - Kal 2011, python port of 2006 C version
Modified to work with python3 by c_d 2014
hostid=007f0101, hostname=SRED, ioukey=7f022f

Add the following text to ~/.iourc:
[license]
SRED = eb8d7f0235852d2d;

You can disable the phone home feature with something like:
 echo '127.0.0.127 xml.cisco.com' >> /etc/hosts

Copy the SRED license with header to /opt/unetlab/addons/iol/bin/iourc file. In the end, you will need to have something like this:

root@SRED:/opt/unetlab/addons/iol/bin# cat iourc 
[license]
SRED = eb8d7f0235852d2d;

A4. Go to eve-ng webui and create a new node, using 'Cisco IOL' template. Keep the default config, then start it. No other configurations are required.

The already existing firewall will be called from now Local-FortiGate and the new one Remote-FortiGate.

FGT_81 # config global

FGT_81 (root) # show system interface ?

B1. Local-FortiGate (first FGT): save the config (admin > Configuration > Revisions > save changes > add comment 'after_vdom_config'), then revert to an old revision 'before_vdom_enabled' (from the 7th lab - VDOM, in case you have it). Wait for machine to reboot, then access it from CLI and check the ip for port1 (mgmt) as it might be changed.

Stop it, then connect port4 to port 4, when the node from below is created, port2 to client1 (via switch), and port3 to client2 (via switch).

B2. Remote-FortiGate (secondary FGT): create a new node with 4 interfaces, 1 vCPU, 2 GB RAM, then connect port1 to Cloud0 (already added to the topology), port2 to client1 (via switch), port3 to client2 (via switch), and port4 to Local-FGT (via port4) . Start the FGT (Remote-FortiGate), then you will need firstly to change the mac address:

# config sys int
# edit port1
# set macaddr <MAC address> - use here the format: 50:00:00:byte_2_eveng_ip:byte3_eveng_ip+1:byte4_eveng_ip
# end
# exec router restart

Connect to machine via browser, then upload the new license file. Do not configure port2 and port3, as their ips will be synced with the local-forti.

At last, all nodes should be connected as seen below:

We are going again to use the pdf file with Fortinet Exercises - go to Lab 7: High Availability (page 125).

For exchanging the heartbeat messages between the firewalls, use port4 (instead of port2, as stated on pdf).

FGT81_2 # config sys ha 
FGT81_2 (ha) # set group-id 81 # use the 4th byte of your eveng ipv4 address
FGT81_2 (ha) # end

At the end, on the remote FGT (that with priority 100), you will see the following:

and check also the system status:

# primary
FGT81 # get sys status
[...]
Current HA mode: a-a, master
# backup
FGT81_2 # get sys status
[...]
Current HA mode: a-a, backup

For session statistics, ping from each client the other one.

For failover triggering, we cannot ping external ip or access youtube website (due to blackhole for def route) and instead, ping with delay of 1 sec client2 from client2:

client1@hostname:$ ping -i 1 172.16.0.2 # client2 ip
[...]

In this time, do the failover and see if ping requests are dropped (FGT secondary changing to primary should be smoothless).

After resetting the secondary firewall, you should see the following logs (election in cluster):

Look here only over the first part (access secondary fortigate remotely via CLI).