|Components||FortiGate HA Clusters running FortiOS 4.00 MR3 or 5.0.x|
You can use SNMP to manage a cluster by configuring a cluster interface for SNMP administrative access. Using an SNMP manager you can get cluster configuration and status information and receive traps.
Configuring SNMP for a cluster si done in the same way as configuring SNMP for a standalone FortiGate unit. SNMP configuration changes made to the cluster are shared by all cluster units.
This article also describes how to use a special community name with to get configuration and status information for any cluster unit (including subordinate units, also called slave units).
|SNMP get command for the primary unit||
Normally, to get a configuration and status information for a standalone FortiGate unit or for a primary unit, an SNMP manager would use an SNMP get command to get the information in a MIB field. The SNMP get command syntax would be similar to the following:
snmpget -v2c -c <community_name> <address_ipv4> <OID>
The following SNMP example command gets the HA status table for the primary unit.
snmpget -v2c -c public 10.10.10.1 220.127.116.11.4.1.12318.104.22.168
The community name is
|SNMP get command for any cluster unit||
To get configuration status information for a specific cluster unit (for the primary unit or for any subordinate unit), the SNMP manager must add the serial number of the cluster unit to the SNMP get command after the community name. The community name and the serial number are separated with a dash. The syntax for this SNMP get command is:
snmpget -v2c -c <community_name>-<fgt_serial> <address_ipv4> <OID>
If the serial number matches the serial number of a subordinate unit, the SNMP get request is sent over the HA heartbeat link to the subordinate unit. After processing the request, the subordinate unit sends the reply back over the HA heartbeat link back to the primary unit. The primary unit then forwards the response back to the SNMP manager.
If the serial number matches the serial number of the primary unit, the SNMP get request is processed by the primary unit. You can actually add a serial number to the commuity name of any SNMP get request. But normally you only need to do this for getting information from a subordiate unit.
To get the HA status table for a subordinate unit:
The following SNMP get command gets the HA status table for a subordinate unit in a FortiGate-5001SX cluster.
snmpget -v2c -c public-FG50012205400050 10.10.10.1 22.214.171.124.4.1.123126.96.36.199
The subordinate unit has serial number FG50012205400050.
FortiGate SNMP recognizes the community name with syntax
|Getting serial numbers for all the units in a cluster||
To be able to use the SNMP get command to display system information for any cluster unit you need to know each cluster unit serial number. If you do not have the serial numbers available, you can use the following SNMP command syntax to get all cluster unit serial numbers through fnHaStatsSerial MIB OID or its numerical OID
The following SNMP get command uses the MIB field name to get all cluster unit serial numbers. IP address of the FortiGate HA Master being 10.10.10.1.
snmpwalk -v2c -c public 10.10.10.1 fnHaStatsSerial
.188.8.131.52.4.1.123184.108.40.206.1.2.1 = STRING: "FG50012205404322"