FortiNAC
NOTE: FortiNAC is now named FortiNAC-F. For post-9.4 articles, see FortiNAC-F. FortiNAC is a zero-trust network access solution that provides users with enhanced visibility into the Internet of Things (IoT) devices on their enterprise networks.
FortiKoala
Staff
Staff
Article Id 198233
Description
named.conf Not Replicating in L3 High Availability (HA) Environment

Scope
Version:   All
Solution
Version:  All

Issue:  In a L3 High Availability environment, the Secondary Application Server's named.conf is missing networks in the ACL entries that are present in the Primary Server's named.conf.  Consequently, upon failover, the captive portal pages do not build for all the Isolation scopes. 

Example:
Primary Server entry using the Isolation network:
acl "isol"      { 192.168.23.2/32; 192.168.23.0/24;  };

Secondary Server entry:
acl "isol"      { 127.0.0.16/32;  };


Named.conf is not replicated in L3 HA configurations.  The FQDN in the named.conf file although often the same, could be different. Therefore, this file can't be replicated from the Primary Server. 

Workaround: 

Edit /bsc/siteConfiguration/named.conf on the Secondary Application Server and add the missing ACLs.
Restart named service (if Secondary is in control):
service named restart    
(centOS 5)
or
service named-chroot restart  (centOS 7)


Solution:  Add DHCP scopes to ConfigWizard for both Primary and Secondary Servers.  This will ensure all the appropriate files are written with the correct values.
If adding scopes via CLI, add ACL entries to both Primary and Secondary
/bsc/siteConfiguration/named.conf files. 



Contributors