Fortigate Troubleshooting

針對Fortigate 我自己遇到的一些問題處理

1.HA問題
2.Switch Mode Interface Mode
3.LACP 設定
4.FortiClient無法安裝
5.LDAP帳戶無法登入
6.FSSO Polling-Mode debug
7.常用指令
8.參考文件

1.HA問題

啟用HA時,發生以下錯誤訊息
Please disable switch-controller first.
圖片1

目前FortiOS 5.2 不支援Switch Controller HA (5.4後將支援) ,必須先關閉Switch Controller  (此問題只有部分型號才會受影響),指令如下:

#config system global
(global) # set switch-controller disable
(global) # end

啟用HA時,發生以下錯誤訊息
get slave and master have different hdisk status. Cannot work with HA master. Shutdown the box!
圖片1

部分設備雖然型號一樣,但仍然無法建立HA Cluster,原因是設備底層的hardware reversion 不相同,必須使用以下指令來忽略 (忽略後需要重開設備)

以下機型可能會有這樣的問題產生,請注意

  • FortiGate-100D
  • FortiGate-300C
  • FortiGate-80C and FortiWiFi-80C
  • FortiGate-60C
#execute ha ignore-hardware-revision enable

2.Switch Mode Interface Mode

80C100

#config system global
(global)#set internal-switch-mode interface 
(global)#end
Changing switch mode will reboot the system!
Do you want to continue? (y/n)y

若跳出以下錯誤訊息,表示有物件使用到internal port,把它給刪除既可

Interface internal is in use
attribute set operator error, -23, discard the setting
Command fail. Return code -23

這邊可以看到那些物件
101

60D,70D,100D 預設都使用Hardware Switch
102
刪除方式如下 (一樣需要確認是否有物件佔用,否則也是無法刪除)

#config system virtual-switch

刪除Name

(virtual-switch) # delete ?
*name Name of the virtual switch.
internal
(virtual-switch) # delete internal

3.LACP 設定
增加Port 1 & Port 2
LACP
設定LACP mode Passive

#config system interface
(interface) #edit LAN

設定LACP mode dynamic passive

(LAN) # set lacp-mode ?
static use static aggregation, do not send and ignore any LACP messages
passive passively use LACP to negotiate 802.3ad aggregation
active actively use LACP to negotiate 802.3ad aggregation
(LAN) # set lacp-mode passive
(LAN) # end

4.FortiClient無法安裝
安裝時發生以下狀況
2hdunts
直接安裝以下安全性更新KB3033929
https://www.microsoft.com/zh-TW/download/details.aspx?id=46148
安全性更新說明
https://technet.microsoft.com/library/security/3033929

5.LDAP帳戶無法登入
測試LDAP連線正常,但是實際登入時卻又無法正常登入
00
通常與Common Name Identifier參數有關,因為在建立AD使用者時, cn attribute並非是實際帳戶欄位,可嘗試使用sAMAccountName attribute可使用LDAP Browser確認

6.FSSO Polling-Mode debug
查詢SSO Polling mode 是否運作正常

#diag debug fsso-polling detail
AD Server Status: 
ID=1, name(10.192.1.3),ip=10.192.1.3,source(security),users(5)
port=auto username=cnlinktw\administrator
read log offset=123298750, latest logon timestamp: Fri Dec 16 10:31:28 2016

polling frequency: every 10 second(s) success(471), fail(0) 每10秒測一次
LDAP query: success(41), fail(7)
LDAP max group query period(seconds): 0
Number of users logged in:
Within 1 sec: 0(0.00%)
Within 1-5 secs: 0(0.00%)
Within 5-10 secs: 0(0.00%)
Within 10-15 secs: 0(0.00%)
Within 15-20 secs: 0(0.00%)
Within 20-25 secs: 0(0.00%)
Within 25-30 secs: 0(0.00%)
Within 30-60 secs: 0(0.00%)
Beyond 60 secs: 0(0.00%)
most recent connection status: connected
Group Filter: 塞選 Domain User
CN=Domain Users,CN=Users,DC=cnlink,DC=net,DC=tw

查詢使用者登入哪台DC

#diag debug fsso-polling user 1

7.常用指令
查看Firmware 版本、SN

#get system status | grep Version
#get system status | grep Serial

查看目前誰登入了設備

#get system admin list

設定Fail2ban機制

#config system global

嘗試登入5次錯誤就封鎖

(global) # set admin-lockout-threshold 5

每次封鎖時間 300秒

(global) #set admin-lockout-duration 300

設定管理者登入數量10

(global) #set admin-login-max 10

查看目前連線狀況,配合grep擷取你想要的資訊

#get system session list | grep udp

查看路由表

#get router info routing-table all

重啟路由 (有時候路由不生效可以嘗試看看)

#execute router restart

查詢ARP,配合grep擷取你想要的資訊

#get system arp | grep 10.0.0.100

NAT IP 查詢,當有使用VIP或者IP Pool 要特別注意
查詢NAT VIP

#show firewall vip 

查詢NAT ip pool

#show firewall ippool

設定開啟不對稱路由

# config system settings
(settings) # set asymroute enable
(settings) # end

關閉 Fortigate 使用SIP LAG

# config system settings
(settings) # set sip-helper disable
(settings) # set sip-nat-trace disable

需重新開機

設定SSLVPN  認證LDAP 若密碼到期可強制通過SSLVPN 修改密碼

# config user ldap
#set password-expiry-warning enable
#set password-renewal enable

查看CPU、記憶體、Process 狀態

#diagnose sys top
Run Time: 330 days, 12 hours and 4 minutes
0U, 0N, 2S, 98I; 499T, 269F, 83KF
 miglogd 52 S 0.4 3.4
 src-vis 76 S 0.0 7.9
 pyfcgid 1904 S 0.0 4.3
 pyfcgid 1906 S 0.0 4.3
 pyfcgid 1907 S 0.0 4.3
 pyfcgid 1908 S 0.0 4.3
 httpsd 1087 S 0.0 4.2
 httpsd 1089 S 0.0 4.2
 cmdbsvr 34 S 0.0 3.9
 httpsd 54 S 0.0 3.6
 httpsd 1086 S 0.0 3.4
 dnsproxy 84 S 0.0 3.3
 ipshelper 63 S < 0.0 2.9
 newcli 1923 R 0.0 2.7
 newcli 1911 S 0.0 2.7
 fgfmd 86 S 0.0 2.6
 cw_acd 87 S 0.0 2.3
 pimd 47 S 0.0 2.1
 forticldd 65 S 0.0 2.0
 fcnacd 67 S 0.0 1.9
Letter Description
U User cpu usage (%)
S System cpu usage (%)
I Idle cpu usage (%)
T Total memory
F Free memory
KF Kernel free memory
Column #1 Column #2 Column #3 Column #4 Column #5
Process name Process identification (PID) One letter process status.

 

S: sleeping process

R: running process

<: high priority

CPU usage (%) Memory usage (%)

Kill Process (類似Linux Kill)
SIGTERM (15):依照正常程序結束行程
SIGKILL (9):強制立即結束行程
SIGKILL (11):重新啟動行程

#diagnose sys kill  9 100

8.參考文件
Firmware 升級文件(Support Upgrade Guide)
http://cookbook.fortinet.com/sysadmins-notebook/supported-upgrade-paths-fortios
查詢Maximum Values Table (修改連結上的版本號,則可看到自己想要的版本號)
http://docs.fortinet.com/d/fortigate-fortios-5.2.7-maximum-values-table

Facebook Comments