Virtual Interfaces

When operating in L3 Routing mode, Virtual Interfaces can be configured in order to act in much the same way as the standard physical interfaces on a device: they can be assigned an IP (or range of IPs), subnet, and gateway, and can be used to isolate clients in their own pri-

Virtual Interfaces

vate IP range. Once a Virtual Interface is created, it can be mapped to a DHCP scope (see Feature Group) and an ESS in order to service clients.

To view the virtual interface table, access the WebUI and navigate to Configuration > Wired > Virtual Interface. Note that until at least one interface has been created, the table will be blank.

Adding a Virtual Interface

To create a new virtual interface, access the Virtual Interface Table and click Add. The Virtual Interface – Add screen appears. See Figure 43.

Figure 43: Creating a Virtual Interface

Provide the required details as described in the following table.

TABLE 13: Virtual Interface Fields

Field	Description
Virtual Interface Profile Name	Enter a descriptive name for the interface. Note that this must be between 1 and 32 characters in length.
Enable/Disable	Use this drop-down to enable or disable the virtual interface.
Subnet IP Address	Enter the subnet to be used by the interface. This is typically in the xxx.xxx.xxx.0 format, as shown above.
Subnet Mask	Enter the subnet mask for the interface. This is typically in the 255.255.255.0 format, as shown above.
Gateway IP Address	Specify the IP address for the gateway on the selected subnet. This is typically in the xxx.xxx.xxx.1 format, as shown above.

Once the fields are filled in, click OK to save the interface. Repeat this process for as many interfaces as desired. After the interfaces have been created, you can assign them a DHCP scope. Refer to Feature Group for further instructions.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Configuring Management Interfaces

The Management Interfaces table (Configuration > Devices > System Settings > Management Interfaces) allows the user to control how traffic is sent from the controller to the wireless network. Refer to the following sections for each tab in the table.

Physical Interfaces

The Physical Interfaces table is where the user may configure the IP information for the physical Ethernet ports on the controller. The number of ports that may be configured will vary depending on the controller model purchased.

Add a Physical Interface

To configure a new physical interface, follow the steps below:

1. From the Physical Interfaces table, click Add. The Management Interface-Add window appears.

Configuring Management Interfaces

Figure 39: Adding a Physical Interface

2. Add in the required data as described in the table below.

Field	Description
Interface Number	The number for the desired interface.
Assignment Type	Specifies whether the interface utilizes a Static or Dynamic IP address.
IP Address	If using a static IP, enter the IP address to be used by the interface.
NetMask	If using a static IP, enter the NetMask for the interface.
Gateway Address	If using a static IP, enter the gateway address for the interface.
Interface Mode	Specify whether the interface will be a active redundant.

3. Click Save to save the interface. Note that the controller must be rebooted in order to apply the changes.

VLAN Interfaces

VLAN Interfaces allow the user to specify VLANs that are to be used specifically for Management traffic on the network. This traffic includes:

• Communications between the controller and APs or controller to controller Access to the WebUI or CLI

Configuring Management Interfaces

• SNMP traffic
• Communications to the Network Management server and any additional Fortinet applications (SAM, Spectrum Manager, etc)
• Syslog messages
• Authentication server traffic (RADIUS, TACACS+, etc)
• NTP communications

Using this functionality, users can isolate management traffic from the rest of the network and route it specifically to the devices for which it is intended. Follow the steps in the section below to create a VLAN interface.

Add a Management VLAN Interface

1. From the VLAN Interfaces table, click Add. The Management Interface-Add window appears.

Figure 40: Adding a VLAN Interface

2. Add in the required data as described in the table below.

Field	Description
VLAN Name	Enter a name for the VLAN.
Interface Number	The physical interface number to be used. Note: Management VLANs must utilize Interface number 1, so this field cannot be modified.
Tag	Enter a tag for the VLAN.

Configuring Management Interfaces

Field	Description
IP Address	Enter the IP address to be used by the VLAN.
NetMask	Enter the NetMask for the VLAN.
Default Gateway	Enter the gateway to be used by the VLAN.
Assignment Type	Management VLANs can only be implemented on static IP addresses, so this field cannot be changed.
Interface Mode	Management VLANs can only operate on Active interfaces, so this field cannot be changed.

3. Click Save to save the VLAN. The new VLAN will appear in the VLAN Interfaces table.

Using Static Routes

Static routes allow the system administrator to manually define the adapters that are permitted access to configured subnets. This is of particular use in smaller deployments where only a few routes are needed, or in larger ones where certain subnets must be kept separate from each other. Static routing can also be advantageous in that it doesn’t require the processing power that dynamic routes (in which the network router automatically determines the best delivery path for packets) can.

To view the static route table, access the WebUI and navigate to Configuration > Devices > System Settings > Management Interfaces > Static Route. Figure 41: Static Route Table

Adding a Static Route

To create a new static route, access the Static Route Table and click Add. The Static Route Configuration – Add screen appears.

Configuring Management Interfaces

Figure 42: Creating a Static Route

Provide the required details as described in the following table.

TABLE 12: Static Route Fields

Field	Description
Static Route Name	Enter a descriptive name for the route. Note that this must be between 1 and 16 characters in length.
IP Address/Subnet	Enter the subnet for which the route provides access. This is typically in the xxx.xxx.xxx.0 format, as shown above.
Subnet Mask	Enter the subnet mask for the route. This is typically in the 255.255.255.0 format, as shown above.
FastEthernet	Use this drop-down to specify which Ethernet adapter will utilize the route. The specified adapter will subsequently gain access to the configured subnet.
Interface Name	The name of the interface used for the route.
Default Gateway	The default gateway for the route.

Once the fields are filled in, click OK to save the route. Repeat this process for as many routes as desired.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Configuring Port Profiles

The Port Profile configuration screen allows you to create custom Ethernet profiles that can be applied to non-primary Ethernet ports on deployed devices. Certain AP models implement multiple Ethernet ports, and while one is always used for wireless service, the remaining ones can be configured by applying a Port Profile to them. If this functionality is not needed, the port can also be disabled via the Port Profile feature.

Each device that is connected to a non-primary port (either directly or through a switch that is wired to the port) can be monitored as a wired station in the controller WebUI (via Monitor > Devices > All Stations). If the interface is configured for tunneled operation and the connected device is a VoIP phone utilizing SIP, the phone will be visible as a SIP phone in the controller’s phone database. Note that the maximum number of wired stations supported per wired interface is 128.

Refer to the following sections for steps on how to configure and apply Port Profiles.

Creating a Port Profile

By default, a default Port Profile is configured in the controller interface. To view the existing Port Profiles, simply open the WebUI and navigate to Configuration > Wired > Port. See Figure 38.

Figure 38: Port Table

Several options can be configured as part of a Port Profile.

Configuring Port Profiles

The following table describes each field displayed.

TABLE 11: Port Profile Options

Field	Description
Port Profile Name	The name provided for the port profile during profile creation.
Enable/Disable	Displays whether the profile is currently enabled for use.
Dataplane Mode	Allows the profile to be configured for either Tunneled or Bridged configuration.
AP VLAN Tag	This field is only configured when the profile is operating in Bridged mode. The VLAN tag is an integer from 0 to 4094 that identifies the VLAN on which the AP resides.
VLAN Name	This field is only used when the profile is operating in Tunneled mode. It allows you to specify the VLAN on which the profile is configured.
Allow Multicast Flag	This option allows you to specify whether multicast transmissions will be permitted via the port in use.
IPv6 Bridging	Specifies whether bridging for IPv6 devices is On or Off.

If desired, the default profile can be modified by checking the box alongside it in the table and clicking Settings. To add a new profile, perform the following steps:

1. From the WebUI, navigate to Configuration > Wired > Port.
2. Click Add. The screen refreshes to display the Port Table – Add page.
3. Configure the profile as desired. Refer to Table 11 for descriptions of the configuration options.
4. When finished, click OK to save the new profile.

Once a profile has been created, it can be applied to the desired port(s) on network devices.

Refer to the following section for instructions.

Enabling a Port Profile on a Specific Ethernet Port

To specify a port profile for a given Ethernet port, you must access the Port AP Table; from the Port Profile Table, select the desired profile and click Configuration. The Port AP Table is the second tab provided on the resulting screen.

By default, the Port AP Table is blank; you can manually add ports as desired. To add a port for the profile:

1. From the Port AP Table screen, click Add. The resulting table will allow you to select the AP and Interface ID to which the port profile will apply.
2. Use the drop-down lists to select the desired AP and Ethernet IDs. Note that if the Ethernet Interface Index specified is an Uplink interface (i.e., the interface is its primary connection to the network), it cannot be configured for a port profile and an error message will appear.
3. Click OK to save the changes.

These steps may be repeated for as many profiles as desired.

Enable 802.1x Authentication

Wired clients can be connected to the AP’s Wired Interface directly or can be connected via an L2 switch. In a deployment that uses L2 switch for multiple wired clients, the L2 switch must be configured to pass through 802.1x packets.

To enable 802.1 x authentication for wired clients, do the following:

1. Create a RADIUS profile and security profile (using 802.1x L2 authentication mechanism with Clear Encryption mode )
2. Attach the security profile to the respective port profile configuration.

Enabling using CLI

Create RADIUS Profile default(15)(config)# default(15)(config)# radius‐profile dot1xport default(15)(config‐radius)# ip‐address 10.10.10.10 default(15)(config‐radius)# key meru2002 default(15)(config‐radius)# port 1812 default(15)(config‐radius)# exit

Create Security Profile default(15)# configure terminal default(15)(config)# security‐profile dotxportauth default(15)(config‐security)# allowed‐l2‐modes 802.1x default(15)(config‐security)# encryption‐modes clear default(15)(config‐security)# radius‐server primary dot1xport

Configuring Port Profiles

default(15)(config‐security)# exit

Create Port Profile default(15)# configure terminal default(15)(config)# port‐profile dot1xauth default(15)(config‐port‐profile)# enable default(15)(config‐port‐profile)# dataplane tunnelled default(15)(config‐port‐profile)# security‐profile dot1xportauth default(15)(config‐port‐profile)# exit default(15)#

Enabling using WebUI

Create RADIUS Profile

Create Security Profile

Create Port Profile

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Link Aggregation

Link aggregation allows data traffic across both Ethernet ports on AP resulting in increased throughput and redundancy. You can configure LACP only on the second interface of the AP. Before you configure LACP on the second interface of the AP, enable bonding on the switch that terminates AP. When configured for link aggregation, the second interface of the AP will inherit all properties of the first interface. When enabled, LACP is functional on both ports.

The second interface of the AP is disabled by default and when enabled it functions as the bonded pair to the first interface. The second interface cannot be used in standalone mode. However, when LACP is enabled and if one of the interfaces fails, the second interface takes over and passes traffic. During a failover, the second interface will function only if there is an external power supply or if the switch can provide only power via PoE.

Link aggregation is available only on AP832, AP822, FAP-U421, and FAP-U423. If the switch that terminates the AP does not support LACP, the AP will fall back to non-LACP mode with only one interface passing data traffic. Static bonding is not supported.

Pre-requisites

Before you enable LACP on the AP, ensure that you do the following

• Remove port AP entry from the port profile of that AP.
• Enable LACP support for the ports on the switch that terminates the AP.
• AP requires 802.3at power to support LACP.

NOTE: If the switch does not support LACP, the AP will work in non-LACP mode.

Link Aggregation

 

Enabling LACP in CLI

Use the lacp enable command on an AP’s ethernet interface to enable LACP.

controller(15)# config terminal controller(15)(config)# interface ap 108 2 controller(15)(config‐if‐WiredEth)# lacp enable

Verifying LACP Status

The Uplink Type and LACP column in the show interfaces ap <ap-id> command displays the status of LACP for an AP.

Controller(15)# show interfaces Ethernet ap 108

Type        ID  Name            IfIndex MTU     MAC Address       Admin State Op State  Last Change          Uplink Type LACP     

ap          108 AP‐108          1       1500    00:0c:e6:13:01:a9 Up          Disabled  05/19/2014 20:05:12  Uplink      disable  

ap          108 AP‐108          2       1500    00:0c:e6:13:01:a9 Up          Disabled  05/20/2014 23:51:48  Uplink‐lacp enable   

        Ethernet Table(2 entries)

For additional diagnostics, you can view the Tx and Rx errors of AP interface using the show interfaces Ethernet statistics <ap-ID> command.

Controller(15)# show interfaces Ethernet statistics ap 13

 IfIndex   Node ID Node Name       Type        In Octets     In Errors     Out Octets    Out Errors   

 

• 13 AP‐13           ap          78217745      0             4637677       0            
• 13 AP‐13           ap          0             0             0             0            

LACP      13      AP‐13           ap          78217745      0             4638109       0            

        Ethernet Statistics(3 entries)

Enabling LACP in WebUI

1. Goto Configuration > Devices > AP, select the AP.

Link Aggregation

2. Goto Ethernet Interface tab, and select the second Ethernet Interface and set LACP to Enable.

To batch enable LACP on multiple APs.

1. Goto Configuration > Wired > Ethernet, select all APs and click the Bulk Update button.
2. Set LACP to Enable.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Dual-Ethernet Operation

Dual-Ethernet support enables the controller’s second Ethernet port and provides the ability for it to work either as a redundant interface or a second active interface.

If the second interface is configured as redundant, it will serve as a backup interface to the first interface. This means that it will be idle as long as the first interface is functional and will perform all functions of the first interface if the first interface fails. In a redundant configuration, the first interface can have static or DHCP IP address.

If the second interface is configured as active, it can be configured as a separate interface that can support an additional configuration, for example to support GRE tunneling while the first interface is configured for VLANs.

The first Ethernet interface is treated as the default interface. The responsibility of the default interface is to pass wireless tunnel traffic between the APs and the controller. In addition to the general support of GRE and VLAN, the default interface is also the designated management interface for the controller, providing support for management access traffic via SSH and HTTPS.

It is implicit in the configuration of redundant mode that the second Ethernet interface should be connected to a switch port in which it can perform the same functions as the default Ethernet interface.

Note that when changing from redundant to dual active operation, a controller reboot is required.

Configuring Dual Ethernet

The second Ethernet interface can be configured as either redundant or active. An active interface can be used to support a VLAN or GRE (Generic Routing Encapsulation) tunneling. A redundant interface is a backup interface in case the primary interface fails.

Dual-Ethernet Operation

Configuring a Redundant Interface

See the chapter Implementing Redundancy.

Configuring an Active Interface

The following commands configure Ethernet port 2 as an active interface that can be used to support a VLAN or GRE (Generic Routing Encapsulation) tunneling. The ip address specifies the IP address of the VLAN or GRE local endpoint followed by the associated netmask. The gw command specifies the gateway address, and is a mandatory field.

default# configure terminal default(config)# interface FastEthernet 2

default(config‐if‐FastEth)# ip address 172.26.16.200 255.0.0.0 default(config‐if‐FastEth)# gw 172.26.16.1 default(config‐if‐FastEth)# type active default(config‐if‐FastEth)# exit default(config)# exit

After completing the interface configuration above, to configure a GRE tunnel, see Configure GRE Tunnels in the Security chapter.

Viewing FastEthernet Interface Information

To view the FastEthernet interface 1 configuration, use the show interfaces FastEthernet controller or show interfaces FastEthernet ap commands to display information relating to each type of interface.

To view the FastEthernet interface 2 redundant configuration, use the command show second_interface_status.

Interface and Networking Commands

The following interface and networking configuration commands are available.

Dual-Ethernet Operation

TABLE 10: Interface and Networking Commands

Command	Purpose
controller(config)# interface FastEthernet controller interface-index	Specify the controller interface index (0-31) and enter FastEthernet interface configuration submode.
controller(config)# ip address ip-address mask	Specifies the IP address and subnet mask for the controller. This is used to specify the static IP address if you are not enabling DHCP.
controller(config)# gw ip-address	Specifies the IP address of the default gateway. Used to specify the gateway if you are not using DHCP.
controller# setup	Interactive script that helps set up hostname and other system and networking parameters.
controller# show interfaces FastEthernet statistics	Displays the summary table of Ethernet statistics for the controller and APs.
controller# show interfaces FastEthernet statistics controller	Displays the Ethernet statistics for the controller.
controller# show interfaces FastEthernet statistics ap id	Displays the Ethernet statistics for the AP with the given node ID.
controller# show second_interface_status	Displays the status of the second FastEthernet interface when configured for redundant mode.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Configuring Basic Networking for the Interface

Use the following commands to configure network parameters, if necessary:

• To change the parameters of the FastEthernet port, use the interface FastEthernet command.
• To set up a dynamic IP address assignment for the wireless clients using the DHCP relay server, use the ip dhcp-server ip-address command.
• To set the IP address of the controller, use the ip address ip-address netmask command.
• To set the default gateway, use the ip default-gateway ip-address command.
• To set the domain name, use the ip domainname name command.
• To add one or more DNS name servers, use the ip dns-server ip-address command.

For additional information about configuring network information, see the FortiWLC (SD) Getting Started Guide. For more information about the listed commands, see the FortiWLC (SD) Command Reference.

802.11d Support

The original 802.11 standard defined operation in only a few regulatory domains (countries). 802.11d added the ability for 802.11 WLAN equipment to operate in additional countries by advertising the country code in the beacon. Devices pick up the country code and adjust com-

Configuring Basic Networking for the Interface                                                                                                                      199

 

munication accordingly. You do not have to configure or enable this feature; the Fortinet implementation currently works automatically for all countries listed in setup. There is no show command that displays this feature. Validate 802.11d in the 802.11 Beacons and Probe Response, Country code IE field.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Option 43

Option 43 is not part of any Fortinet product; it is a method for mapping controllers. With DHCP Option 43, you can specify a primary and backup controller for APs. With this configuration, the backup controller can be in a different subnet from the primary controller. Option 43 implements redundancy by specifying which controllers (primary and secondary) an AP should associate to. This feature is supported across all access points. A backup controller can be configured using either DHCP or DNS.

Option 43

For example, using Option 43, if “wlan-controller” is mapped to P1 (and P1 has a redirect to P2) and “wlan-controller-2” is mapped to S1 (and S1 has a redirect to S2), the discovery order would be P1, P2, S1, S2. If a controller has both a DNS entry and Option 43 enabled, the AP will first use the host address as configured on the AP (default value = wlan-controller). If the host address is configured as 0.0.0.0 or if the host is a name and the name cannot be resolved using DNS, only then will the AP look at the DHCP Option 43 value. For specific Option 43 configuration directions, see the Support Portal How-To 4062-125.

AP Aware Redundancy using DHCP Option 43

• Configure APs with L3 preferred and the controller name as 0.0.0.0
• On the DHCP server, Option 43 values need to be configured with primary and secondary controller IPs and/or hostnames. Then, when an AP contacts the DHCP server to obtain an IP address, it also receives primary and secondary controller IP information using the Option 43 value from the DHCP server.

AP Aware Redundancy using DNS

• Configure APs with L3 preferred and the controller name as the hostname of the controller.
• Configure a DNS entry to resolve the primary hostname on the DNS server. Configure a DNS entry to resolve the secondary hostname on the DNS server.
• Configure the hostname of the primary controller on the AP with L3 preferred mode.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

N+1 Redundancy

The optional N+1 redundancy software feature, when implemented, allows a standby N+1 slave controller in the same subnet to monitor and seamlessly failover more than one master controller.

A set of master controllers and a standby slave controller are configured via static IP addressing to reside in the same subnet, and are considered to be an N+1 cluster. The standby slave monitors the availability of the master controllers in the cluster by receiving advertisement messages sent by the masters over a well known UDP port at expected intervals. If four successive advertisements are not received, the standby slave changes state to an active slave, assumes the IP address of the failed master, and takes over operations for the failed master. Because the standby slave already has a copy of the master’s latest saved configuration, all configured services continue with a short pause while the slave switches from standby to active state.

N+1 Fallback

While in the active slave role, the slave controller’s cluster monitoring activities are put on hold until the failed master rejoins the cluster. An active Slave detects the restart of a master through ARP. When the active slave is aware of the master’s return (via the advertisement message) it will continue to remain as active slave and the original master moves to passive state. The now passive master is assigned with original slave’s IP address. To move passive master to active master status, use the nplus1 revert command in active slave.

NP‐MC4200‐master(15)(config)# nplus1 revert

NP‐MC4200‐master(15)(config)# end

NP‐MC4200‐master(15)# sh nplus1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

            Current State : Active‐>Passive Slave

         Heartbeat Period : 1000 milliseconds

      Heartbeat Threshold : 4 threshold

                Master IP : 172.19.215.31

          Master Hostname : NP‐MC4200‐master                  Slave IP : 172.19.215.32

           Slave Hostname : NP1‐MC4200‐slave              License Type : Demo

License Usage (Used/Tot) : 1/1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

             Master Controllers

            Hostname       IP Address  Admin    Status

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

    NP‐MC4200‐master    172.19.215.31  Enable   Passive‐>Active

If it is necessary for the failed master to be off-line for a lengthy interval, the administrator can manually set the active slave back to the standby slave, thereby ensuring the standby slave is able to failover for another master.

Auto Fallback

After a failover, the passive master listens to advertisements (at time intervals specified using the nplus1 period command) from active slave. If the passive master does not receive advertisements from active slave within the time period the passive master initiates auto-fallback.

Auto Revert

When the master controller goes down, the slave controller takes over as active slave controller. When the master controller that was down became active, it continues to stay as passive controller till the nplus1 revert command is executed on the active slave controller. You can enable auto revert so that after the master controller come online, it takes over as the original master controller.

By default this option is disabled. To enable auto-revert, use the nplus1 autorevert enable command. By enabling auto revert; the active slave controller triggers a fallback by itself.

Failover Scenarios

Scenario	Description
Power outage	Failover is initiated on power outage on the master controller.
Switch Port Failure	Failover is initiated during a port failure in the switch.
Ethernet cable unplugged	If the Ethernet cable in the master controller is unplugged, the slave controller takes over and becomes active slave.
Manual Failover	You can execute the nplus1 takeover command in the master controller to force a failover.
np1adv process kill	Failover is initiated if the np1 process in the master is killed.
Auto Failover	Auto failover is initiated if heartbeats from a controller is not received within the time specified in the nplus1 period command.
Failover on “no reload”	no reload commands trigger a failover. In such scenario, the master must be manually enabled. Reload commands sends a notification to slave about force enabling master and hence the master status becomes disable on the slave.

In most cases with a cluster of N+1 Masters, the APs all have to be in L3 Connectivity mode, but if you only have one Master and one Slave unit (N=1) the APs can be in L3 only connectivity mode. However, if the APs are in L2 mode, then they will move to reboot after failover.

Heartbeat Period and Heartbeat Timeout Recommendations

Various factors in your network environment including latency can impact the N+1 failover. In networks with high latency, missing heartbeats between master and slave controller can trigger N+1 failover. We recommend that if your network experiences high latency, you should set the heartbeat period and heartbeat timeout to higher values.

The default heartbeat period is 1000ms and heartbeat timeout is 4 timeouts. Use the following commands to set high values:

# nplus1 timeout 40 # nplus1 period 100

The failure detection time (to initiate failover) is calculated as Heartbeat Period x Heartbeat Timeout.

Default timeout and period:

• Heartbeat Period (HP): Default 1000 ms, Range 100 – 30,000 (ms)
• Heartbeat Timeout (HT): The lost heartbeat threshold is the number of consecutive heartbeat packets. Default 4 timeouts, Range 4 – 60 (timeouts)
• Actual Failure Detection Time (AFDT) = HP (1000 ms) x HT (4) = 4000 ms = 4 Seconds

Preparing the Network

The N+1 cluster must be configured within a set of guidelines to operate as described in the previous section. While configuring your network for N+1 redundancy, the following guidelines must be followed:

• The following table lists the supported pairing (master and slave) of controller models in an N+1 cluster, with the MC series as the master.

Slave				Master
	MC1550	MC1550VE	MC3200	MC3200VE	MC4200	MC4200VE	MC6000
MC1550	✓	x	X	x	x	x	x
MC3200	x	x	✓	x	x	x	x
MC4200	x	x	X	x	✓	x	x
MC6000	x	x	X	x	x	x	✓
MC1550-VE	✓	✓	X	x	x	x	x
MC3200-VE	✓	✓	✓	✓	x	x	x
MC4200-VE	✓	✓	✓	✓	✓	✓	x
FWC-50D	x	x	X	x	x	x	x
FWC-VM-50	x	x	X	x	x	x	x
FWC-200D	x	x	✓	x	x	x	x
FWC-VM-200	x	x	X	x	x	x	x
FWC-500D	x	x	X	x	✓	x	x
FWC-VM-500	x	x	X	x	x	x	x
FWC-1000D	x	x	X	x	x	x	x
FWC-VM1000	x	x	X	x	x	x	x
FWC-3000D	x	x	X	x	x	x	x
FWC-VM3000	x	x	x	x	x	x	x

• The following table lists the supported pairing (master and slave) of controller models in an N+1 cluster, with the FWC series as the master.

Slave					Master
	FWC50D	FWC- VM- 50	FWC200D	FWC- VM- 200	FWC500D	FWC- VM- 500	FWC- 1000 D	FWC- VM1000	FWC- 3000 D	FWC- VM3000
MC1550	x	x	x	x	x	x	x	X	x	X
MC3200	x	x	✓	x	x	x	x	x	x	x
MC4200	x	x	x	x	✓	x	x	x	x	x
MC6000	x	x	x	x	x	x	x	x	x	x
MC1550-VE	x	x	x	x	x	x	x	x	x	x
MC3200-VE	✓	x	✓	x	x	x	x	x	x	x
MC4200-VE	✓	x	✓	x	✓	x	x	x	x	x
FWC-50D	✓	x	x	X	x	x	x	x	x	x
FWC-VM-50	x	✓	x	X	x	x	x	x	x	x
FWC-200D	x	x	✓	X	x	x	x	x	x	x
FWC-VM200	x	x	x	✓	x	x	x	x	x	x
FWC-500D	x	x	x	X	✓	x	x	x	x	x
FWC-VM500	x	x	x	X	x	✓	x	x	x	x
FWC-1000D	x	x	x	X	x	x	✓	x	x	x
FWC-VM1000	x	x	x	X	x	x	x	✓	x	x
FWC-3000D	x	x	x	X	x	x	x	x	✓	x
FWC-VM3000	x	x	x	X	x	x	x	x	x	✓

• All master and slave controllers must use static IP addressing to ensure consistency and control of N+1 clustering. (DHCP addresses are not supported for controllers participating in the N+1 cluster).
• Master and slave controllers must be on the same IP subnet.
• All APs in the network should be configured for Layer 3 connectivity with the controller.
• Spanning tree should be disabled on the switch port to which the controllers are connected. To disable spanning tree on the port, refer to your switch configuration documentation.
• Set same date and time on the master and slave controller. Mismatch in date and time between master and slave will result in incorrect AP uptime information after a failover. You can also configure NTP on the master to avoid incorrect AP uptime information.

Configuring the N+1 Clusters shows a simplified network diagram of a recommended N+1 deployment.

Figure 37: Example N+1 Redundancy Network Deployment

Configuring the N+1 Clusters

This can only be configured using the CLI and up to five masters and one slave. You will need passwords for all controllers involved in the N+1 configuration. A summary of the steps to configure and start N+1 follows:

Step	Command	Description
1.	nplus1 start master	On each master, start N+1 redundancy.
2.	nplus1 start slave	Start N+1on the slave controller.
3.	nplus1 add master_hostname master_IP_address	Add the master controller’s hostname and IP address to the slave’s cluster list.

Starting N+1 on Master Controllers

N+1 must first be started on the Master Controllers.

To configure a master controller:

1. On each master controller, enter configuration mode and start the N+1 software:

NP‐MC4200‐master(15)# configure terminal

NP‐MC4200‐master(15)(config)# nplus1 start master

2. Exit configuration mode and check that the N+1 software has been started on that controller:

NP‐MC4200‐master(15)(config)# exit

NP‐MC4200‐master(15)# sh nplus1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐Master controller

Master IP : 172.19.215.31

Master Hostname : NP‐MC4200‐master

Master Status : Active

Slave IP : 172.19.215.32 <– This is not displayed if Slave is not started

Slave Status : Passive <– This is displayed as Unknown if slave is not started

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

Configuring N+1 on the Slave Controller

After starting N+1 on each of the Master Controllers, start N+1 on the Slave Controller, and then add each Master Controller to the Slave Controller.

The Slave Controller must be the last controller in the cluster to start N+1. All Master Controllers must be added to the cluster before starting N+1 on the Slave Controller.

To configure N+1 on the slave controller, follow these steps:

1. Enter configuration mode and start the N+1 software:

NP1‐MC4200‐slave(15)# configure terminal

NP1‐MC4200‐slave(15)(config)# nplus1 start slave

Setting up this controller as a Passive Slave controller

2. Check that the software has started on the slave with the show nplus1 command (note that no masters display in the Master Controllers list):

NP1‐MC4200‐slave(15)(config)# show nplus1

Current State : Passive

Heartbeat Period : 1000 milliseconds

Heartbeat Threshold : 4 threshold Slave IP : 172.19.215.32

Slave Hostname : NP1‐MC4200‐slave

License Type : Demo

License Usage (Used/Tot) : 0/1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐        Master Controllers

                                                                                        

Hostname  IP Address  Admin Status Switch  Reason Missed Adverts SW Version ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

3. Supply the hostname and IP address of each master controller in the cluster. You will be prompted for the controller’s password to complete the addition:

NP1‐MC4200‐slave(15)# configure terminal

NP1‐MC4200‐slave(15)(config)# nplus1 add NP‐MC4200‐master  172.19.215.31 admin@172.19.215.31 Password:

4. Exit configuration mode and check that the master controller has been enabled (the Admin status is now Enable):

NP1‐MC4200‐slave(15)#sh nplus1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

            Current State : Passive

         Heartbeat Period : 1000 milliseconds

      Heartbeat Threshold : 4 threshold

                 Slave IP : 172.19.215.32

           Slave Hostname : NP1‐MC4200‐slave

             License Type : Demo

 License Usage (Used/Tot) : 1/1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐                       Master Controllers

                                                                                          Hostname   IP Address  Admin  Status Switch  Reason  MissedAdverts  SW Version

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

NP‐MC4200‐master 172.19.215.31  Enable  Active  Yes     ‐    0        6.1‐2‐15

Monitoring the N+1 Installation

The show nplus1 command allows you to check the current controller configuration and show the status of the controller. Some sample output displays are included to show the information displayed in the various controller states.

• N+1 on master—displays both basic master and slave controller identification information

NP‐MC4200‐master(15)# sh nplus1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐Master controller

Master IP : 172.19.215.31

Master Hostname : NP‐MC4200‐master

Master Status : Active

Slave IP : 172.19.215.32

Slave Status : Passive

• N+1 on a standby slave—basic slave controller identification information plus the status for the master control-lers in the cluster (accompanying table describes status fields)

NP1‐MC4200‐slave(15)#sh nplus1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

            Current State : Passive

         Heartbeat Period : 1000 milliseconds

      Heartbeat Threshold : 4 threshold

                 Slave IP : 172.19.215.32

           Slave Hostname : NP1‐MC4200‐slave

             License Type : Demo

 License Usage (Used/Tot) : 1/1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐                       Master Controllers

                                                                                          Hostname   IP Address  Admin  Status Switch  Reason  MissedAdverts  SW Version

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

NP‐MC4200‐master 172.19.215.31  Enable  Active  Yes     ‐    0        6.1‐2‐15 The descriptions of the display fields are provided in the following table:

Field	Description
Hostname	Hostname of the master controller
IP Address	Static IP address assigned to the master controller
Admin	Status of N+1 redundancy on the master: •  Enable—N+1 redundancy has been enabled on the master •  Disable—N+1 redundancy has been disabled
Switch	Ability of the slave to assume active slave for the master: •  Yes—Slave and master model/FortiWLC (SD) version number are compatible •  No—Slave and master model/sFortiWLC (SD) version number are incompatible or the administrator has disabled N+1 on the master
Field	Description
Reason	If Switch is No, describes why switch cannot be made: •  Down: Master has been disabled by the user •  SW Mismatch: The FortiWLC (SD) software is out of sync (update the Master Controller). •  No Access: The Passive Slave was not able to access the Master because it did not receive a copy of the configuration. This is a rare message that occurs if show nplus1 is executed almost immediately after adding a controller.
Missed Adverts	Number of consecutively missed (not received) advertisements (a maximum of 4 triggers a failover if the Switch field is Yes).
SW Version	The software version of FortiWLC (SD) on the controller.

• N+1 on an active slave—the master IP address, hostname, and status are added to the display. Passive status indicates the original master is UP, Down status indicates the original master is not reachable.

NP‐MC4200‐master(15)# sh nplus1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

            Current State : Active Slave

         Heartbeat Period : 1000 milliseconds

      Heartbeat Threshold : 4 threshold

                Master IP : 172.19.215.31

          Master Hostname : NP‐MC4200‐master                  Slave IP : 172.19.215.32

           Slave Hostname : NP1‐MC4200‐slave

             License Type : Demo

 License Usage (Used/Tot) : 1/1

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

              Master Controllers

            Hostname       IP Address  Admin    Status

‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐

    NP‐MC4200‐master    172.19.215.31  Enable   Passive  

Managing the N+1 Installation

The tasks to manage an N+1 installation include:

• Syncing Running Configuration
• Disabling and Deleting N+1 Master Controllers
• Stopping N+1 Installations
• Replacing a Master Controller
• Working with N+1 Syslog

Syncing Running Configuration

Running configuration between master and slave are automatically synced every 30 minute.

Disabling and Deleting N+1 Master Controllers

To disable N+1 operation on a master controller, but still maintain its configuration in the cluster, from the slave controller, use the nplus1 disable command, with the IP address of the controller you are deleting:

NP1‐MC4200‐slave# configure terminal

NP1‐MC4200‐slave(config)# nplus1 disable 10.1.1.10 NP1‐MC4200‐slave(config)# end

To remove an N+1 master controller from the cluster, from the slave controller, use the nplus1 delete command, with the IP address of the controller you are deleting:

NP1‐MC4200‐slave# configure terminal

NP1‐MC4200‐slave(config)# nplus1 delete 10.1.1.10

NP1‐MC4200‐slave(config)# end

Stopping N+1 Installations

N+1 Slave and N+1 Master Controllers must be stopped separately.

Stopping N+1 Slave Controllers

To stop N+1 on a Slave Controller:

NP1‐MC4200‐slave# configure terminal

NP1‐MC4200‐slave(config)# nplus1 stop

Making this a normal controller.

NP1‐MC4200‐slave(config)# exit NP1‐MC4200‐slave#

Stopping N+1 Master Controllers To stop N+1 on a Master Controller:

3000‐1# configure terminal

3000‐1(config)# nplus1 stop

3000‐1(config)# exit

The following commands cannot be executed in an active slave controller and if executed on an active master, these commands will not trigger failover.

• poweroff controller
• reload
• reload default
• reload default factory

Replacing a Master Controller

To replace a a new master controller, do the following:

1. Power off the original master controller. The slave controller becomes the active controller.
2. Replace the new controller. Ensure that the new controller contains the same configuration for bonding, interface mode, and IP address(es) as the original master controller.
3. Run “nplus1 start master” command on the new controller in order to make this new controller the master controller.
4. Run “nplus1 slave <slave’s IP address>” command on the the new master controller in order to detect slave controller. The new master controller takes passive role.
5. Run “nplus1 access <slave’s IP address>” command on active slave controller in order to generate authorized key on the new passive master controller.
6. Then, copy the latest running configuration to the new passive master controller after executing the “nplus1 revert” command on the active slave controller

The the new active master controller automatically runs with the latest running configuration.

Working with N+1 Syslog

The show nplus1 debugloglevel command shows the level of verboseness set for the N+1 log messages.

NP1‐MC4200‐slave# sh nplus1 debugloglevel nplus1 Debug Logging Level: 0 NP1‐MC4200‐slave#

Setting the syslog Debug Level

The nplus1set debugloglevel command sets the level of verboseness for the N+1 log messages. The level can be set from 0 to 3, where 1 is the least verbose. The default 0 setting disables syslog messaging.

NP1‐MC4200‐slave(config)# nplus1 setdebugloglevel 1

N+1 Syslog Messages

Syslog messages are generated and sent to a log file on the syslog server configured with the syslog-host command. These message are sent by a standalone N+1 slave controller when an error condition occurs. A sample syslog message follows:

Oct 26 14:02:45 slave nplus1_Slave: <error message> The list of syslog messages are as follows:

Error Message	Description/Remedy
IP address not assigned. Please run setup before using nplus1	The command nplus1 start slave executed, but no IP address exists for the controller. Run the setup command on that controller and assign the controller a static IP address.
ERROR: Could not get software version from file: meru_sw_version_file	Couldn’t determine the FortiWLC (SD) software version.
Rejecting record number due to parsing issues	Error reading the persistent record of configured masters. Manually add the Master Controllers again.
Could not open socket for CLI server	Problem initializing the N+1 CLI.
CLI server: Bind error for server ip: ip port: port	Issues in initializing N+1 CLI.
ALERT: Software Mismatch: Master (master_ip): software_version Slave (slave_ip): software_version	The Master Controller advertisement revealed a software mismatch. While the version mismatch occurs, the Master Controller cannot provide redundancy. Install on the Master Controller the same software version as the Slave Controller (or vice versa).
Copyback failed for master controller: master_ip	Configuration of Master Controller changed while the Slave was active, and the copyback failed. Remove the new Master Controller configuration changes, failback the Master Controller, and then perform the needed configuration changes.

 

For MC: master_ip State:  SW Mismatch ->  No Access – Saved Config does not exist	Software mismatch was resolved, but the Master Controller is not accessible from the Slave Controller and cannot provide redundancy. Ensure that the Master Controller is accessible using the command nplus1 access master_ip.
Could not access host: master_ip. Setting No Access Count to: count	Could not access the Master Controller. The Master Controller cannot provide redundancy until it is accessible. Access will be rechecked after count (default is 60 seconds). The problem may be caused by a gateway failure. Ensure that the Master Controller is accessible, and verify by using the command nplus1 access master_ip.

Upgrading

Controllers in a N+1 network can be upgraded like any controller in a standalone deployment. However, only active master and standby slave controllers can be upgraded. Controllers in failover mode cannot be upgraded.

Recovering From N+1 Failover

When an N+1 master controller goes down, the slave controller transitions from passive slave to active slave (failover) and starts acting as the master controller. When the original master comes back up, the active slave continues to be active slave and the original master becomes passive master. The APs (if in L2 mode) will now reboot.

Recovering From N+1 with Dual Ethernet Failover

On the Master controller, when the first Ethernet interface goes down, the controller fails over to second interface of the same controller. If the second interface goes down, Nplus1 failover takes place and the N+1 passive slave becomes an active slave with Dual Ethernet redundant configuration.

The active slave is now in control. If the first active slave Ethernet interface goes down, the slave controller fails over to the second Ethernet interface.

To revert the failover, verify that the first interface on the Slave controller is up and running. Then, bring up the first interface of the original Master controller. The N+1 active slave continues to be active slave and the original N+1 master becomes passive.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!