Diagnosing packet loss with two FortiGate HA clusters in the same broadcast domain
A network may experience packet loss when two FortiGate HA clusters have been deployed in the same broadcast domain. Deploying two HA clusters in the same broadcast domain can result in packet loss because of MAC address conflicts. The packet loss can be diagnosed by pinging from one cluster to the other or by pinging both of the clusters from a device within the broadcast domain. You can resolve the MAC address conflict by changing the HA Group ID configuration of the two clusters. The HA Group ID is sometimes also called the Cluster ID.
This section describes a topology that can result in packet loss, how to determine if packets are being lost, and how to correct the problem by changing the HA Group ID.
Packet loss on a network can also be caused by IP address conflicts. Finding and fixing IP address conflicts can be difficult. However, if you are experiencing packet loss and your net- work contains two FortiGate HA clusters you can use the information in this article to elim- inate one possible source of packet loss.
Changing the HA group ID to avoid MAC address conflicts
Change the Group ID to change the virtual MAC address of all cluster interfaces. You can change the Group ID
from the FortiGate CLI using the following command:
config system ha
set group-id <id_integer>
end
Example topology
The topology below shows two clusters. The Cluster_1 internal interfaces and the Cluster_2 port 1 interfaces are both connected to the same broadcast domain. In this topology the broadcast domain could be an internal network. Both clusters could also be connected to the Internet or to different networks.
Example HA topology with possible MAC address conflicts
Ping testing for packet loss
If the network is experiencing packet loss, it is possible that you will not notice a problem unless you are constantly pinging both HA clusters. During normal operation of the network you also might not notice packet loss because the loss rate may not be severe enough to timeout TCP sessions. Also many common types if TCP traffic, such as web browsing, may not be greatly affected by packet loss. However, packet loss can have a significant effect on real time protocols that deliver audio and video data.
To test for packet loss you can set up two constant ping sessions, one to each cluster. If packet loss is occurring the two ping sessions should show alternating replies and timeouts from each cluster.
Cluster_1 Cluster_2
reply timeout
reply timeout
Cluster_1 Cluster_2
reply timeout
timeout reply
timeout reply
reply timeout
reply timeout
timeout reply
timeout reply
timeout reply
timeout reply
Viewing MAC address conflicts on attached switches
If two HA clusters with the same virtual MAC address are connected to the same broadcast domain (L2 switch or hub), the MAC address will conflict and bounce between the two clusters. This example Cisco switch MAC address table shows the MAC address flapping between different interfaces (1/0/1 and 1/0/4).
- 0009.0f09.0002 DYNAMIC Gi1/0/1
- 0009.0f09.0002 DYNAMIC Gi1/0/4